Lucene search

GoogleOSV:GHSA-QWP3-5FW3-5WGV

HistoryAug 20, 2022 - 12:00 a.m.

Incorrect Access Control and Cross Site Scripting in Jellyfin

2022-08-2000:00:39

Google

osv.dev

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

57.4%

JSON

In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality. This lack of access control can be leveraged to performe a cross site scripting attack.

CPENameOperatorVersion
jellyfin.commoneq10.3.5
jellyfin.commoneq10.5.3
jellyfin.commoneq10.7.0-rc4
jellyfin.commoneq10.2.0
jellyfin.commoneq10.8.0-beta3
jellyfin.commoneq10.3.7
jellyfin.commoneq10.8.0-beta2
jellyfin.commoneq10.7.0-rc1
jellyfin.commoneq10.4.2
jellyfin.commoneq10.7.0

Name	Operator	Version
jellyfin.common	eq	10.3.5
jellyfin.common	eq	10.5.3
jellyfin.common	eq	10.7.0-rc4
jellyfin.common	eq	10.2.0
jellyfin.common	eq	10.8.0-beta3
jellyfin.common	eq	10.3.7
jellyfin.common	eq	10.8.0-beta2
jellyfin.common	eq	10.7.0-rc1
jellyfin.common	eq	10.4.2
jellyfin.common	eq	10.7.0

Rows per page:

1-10 of 411

References

docs.google.com/document/d/1cBXQrokCvWxKET4BKi3ZLtVp5gst6-MrGPgMKpfXw8Y/edit

github.com/jellyfin/jellyfin

github.com/jellyfin/jellyfin/pull/7569/files

medium.com/stolabs/cve-2022-35909-cve-2022-35910-incorrect-access-control-and-xss-stored-to-jellyfin-967359c91058

nvd.nist.gov/vuln/detail/CVE-2022-35909

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

57.4%

JSON

Related for OSV:GHSA-QWP3-5FW3-5WGV