GitHub_MVULNRICHMENT:CVE-2024-41665CVE-2024-41665 Ampache Stored Cross-site Scripting Vulnerability
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
AI Score
Confidence
High
EPSS
Percentile
9.4%
SSVC
Exploitation
poc
Automatable
no
Technical Impact
partial
Ampache, a web based audio/video streaming application and file manager, has a stored cross-site scripting (XSS) vulnerability in versions prior to 6.6.0. This vulnerability exists in the “Playlists - Democratic - Configure Democratic Playlist” feature. An attacker with Content Manager permissions can set the Name field to <svg onload=alert(8)>. When any administrator or user accesses the Democratic functionality, they will be affected by this stored XSS vulnerability. The attacker can exploit this vulnerability to obtain the cookies of any user or administrator who accesses the democratic.php file. Version 6.6.0 contains a patch for the issue.
ADP Affected
[
{
"cpes": [
"cpe:2.3:a:ampache:ampache:*:*:*:*:*:*:*:*"
],
"vendor": "ampache",
"product": "ampache",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "6.6.0",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
]Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
AI Score
Confidence
High
EPSS
Percentile
9.4%
SSVC
Exploitation
poc
Automatable
no
Technical Impact
partial