Lucene search

FreeBSD4EE322E9-E363-11ED-B934-B42E991FC52E

HistoryApr 24, 2023 - 12:00 a.m.

jellyfin -- Multiple vulnerabilities

2023-04-2400:00:00

vuxml.freebsd.org

jellyfin

directory traversal

cross-site scripting

vulnerability

patch

10.8.10

file write

arbitrary code execution

media system

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

EPSS

0.001

Percentile

49.9%

JSON

[email protected] reports:

Jellyfin is a free-software media system. Versions starting with
10.8.0 and prior to 10.8.10 and prior have a directory traversal
vulnerability inside the ClientLogController, specifically
/ClientLog/Document. When combined with a cross-site scripting
vulnerability (CVE-2023-30627), this can result in file write and
arbitrary code execution. Version 10.8.10 has a patch for this
issue. There are no known workarounds.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchjellyfin< 10.8.10UNKNOWN

OS	Version	Architecture	Package	Version	Filename
FreeBSD	any	noarch	jellyfin	< 10.8.10	UNKNOWN

References

nvd.nist.gov/vuln/detail/CVE-2023-30626

nvd.nist.gov/vuln/detail/CVE-2023-30627

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

EPSS

0.001

Percentile

49.9%

JSON

Related for 4EE322E9-E363-11ED-B934-B42E991FC52E