PT-2024-32839 · Ampache · Ampache

Viliald · Published 2024-10-09 · Updated 2024-10-17 · CVE-2024-47828

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ampache (affected versions not specified)

Description A Cross-Site Request Forgery (CSRF) attack can be performed to delete objects such as playlists and smartlists. This attack forces authenticated users to submit a request to a web application against which they are currently authenticated. The issue can be exploited by creating a malicious script with an arbitrary playlist ID belonging to another user, resulting in the deletion of the user's playlist without their consent. Any user with an active session who is tricked into submitting a malicious request is impacted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-47828

GHSA-P9CQ-2QPH-55F2

Affected Products

Ampache

References · 10

• 🔥 https://github.com/ampache/ampache/security/advisories/GHSA-p9cq-2qph-55f2 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47828.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-47828 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-47828 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-47828 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-47828 · Security Note
• https://ubuntu.com/security/CVE-2024-47828 · Vendor Advisory
• https://twitter.com/CVEnew/status/1844086628890882365 · Twitter Post
• https://t.me/cvenotify/97678 · Telegram Post
• https://t.me/cvedetector/7521 · Telegram Post