PT-2025-9852 · Ampache · Ampache

Nitipoom Jaroonchaipipat · Published 2025-03-05 · Updated 2025-03-07 · CVE-2024-51144

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ampache versions 6.6.0 and earlier

Description A Cross Site Request Forgery (CSRF) issue exists in the "pvmsg.php?action=add message", "pvmsg.php?action=confirm delete", and "ajax.server.php?page=user&action=flip follow" endpoints.

Recommendations For Ampache versions 6.6.0 and earlier, update to a version later than 6.6.0 to resolve the issue. As a temporary workaround, consider restricting access to the "pvmsg.php?action=add message", "pvmsg.php?action=confirm delete", and "ajax.server.php?page=user&action=flip follow" endpoints until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-51144

Affected Products

Ampache

References · 12

• https://osv.dev/vulnerability/UBUNTU-CVE-2024-51144 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-51144 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-51144 · Security Note
• https://osv.dev/vulnerability/CVE-2024-51144 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-51144 · Security Note
• https://github.com/ampache/ampache · Note
• https://twitter.com/CVEnew/status/1897506960523608261 · Twitter Post
• https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2024-51144 · Note
• https://t.me/cvedetector/19653 · Telegram Post
• https://twitter.com/cybercronai/status/1897823422186459453 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1897454310931288106 · Twitter Post
• https://nitipoom-jar.github.io/CVE-2024-51144 · Note