Unauthenticated GET requests through Remote Image endpoints
CVE-2021-29490

5.8MEDIUM

Key Information:

Vendor

Jellyfin

Status
Jellyfin
Vendor
CVE Published:
6 May 2021

What is CVE-2021-29490?

Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. Verions prior to 10.7.3 vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the imageUrl parameter. This issue potentially exposes both internal and external HTTP servers or other resources available via HTTP GET that are visible from the Jellyfin server. The vulnerability is patched in version 10.7.3. As a workaround, disable external access to the API endpoints /Items/*/RemoteImages/Download, /Items/RemoteSearch/Image and /Images/Remote via reverse proxy, or limit to known-friendly IPs.

Affected Version(s)

jellyfin <= 10.7.2

References

https://github.com/jellyfin/jellyfin/security/advisories/...
x_refsource_CONFIRM

EPSS Score

89% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.