Lucene search
HistoryAug 19, 2022 - 1:15 p.m.
CVE-2022-35910
cve-2022-35910
jellyfin
stored xss
admin access token
security vulnerability
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.2 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
27.0%
In Jellyfin before 10.8, stored XSS allows theft of an admin access token.
Affected configurations
Node
jellyfinjellyfinRange<10.8
| CPE | Name | Operator | Version |
|---|---|---|---|
| jellyfin:jellyfin | jellyfin | lt | 10.8 |
References
Social References
More
Related
prion
prion
Cross site scripting
2022-08-19 13:15:00
nvd
nvd
CVE-2022-35910
2022-08-19 13:15:08
cvelist
cvelist
CVE-2022-35910
2022-08-19 11:52:33
osv
osv
Incorrect Access Control and Cross Site Scripting in Jellyfin
2022-08-20 00:00:39
CVE-2022-35910
2022-08-19 13:15:08
CVE-2022-35909
2022-08-19 13:15:08
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.2 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
27.0%
Related for CVE-2022-35910