SQL Injection Vulnerability in Ampache Products by Ampache
CVE-2019-12385

8.8HIGH

Key Information:

Vendor

Ampache

Status
Ampache
Vendor
CVE Published:
22 August 2019

What is CVE-2019-12385?

Ampache has a significant security issue that allows SQL Injection through its search engine functionality. Users with access to perform searches can exploit this vulnerability to extract sensitive data from the database, including sessions and hashed passwords. The impact could be severe, especially when coupled with a flawed password generation method in the password recovery feature, potentially leading to a complete takeover of administrator accounts. Immediate updates and security measures are recommended for all users of affected versions.

References

https://www.tarlogic.com/en/blog/vulnerabilities-in-ampache/
x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2019/11/msg0...
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.