Audiobookshelf Arbitrary File Read Vulnerability
CVE-2023-47624

7.5HIGH

Key Information:

Vendor

advplyr

Status
audiobookshelf
Vendor
CVE Published:
13 December 2023

What is CVE-2023-47624?

Audiobookshelf is a self-hosted audiobook and podcast server that has a vulnerability in versions up to 2.4.3. Due to a path traversal issue present in the /hls endpoint, unauthorized users may exploit this flaw to access and read files from the local file system, potentially leading to sensitive information disclosure. As of the current date, there are no available patches for this vulnerability, highlighting the need for users to be cautious regarding their deployment of this software.

Affected Version(s)

audiobookshelf <= 2.4.3

References

https://securitylab.github.com/advisories/GHSL-2023-203_G...
x_refsource_CONFIRM
https://github.com/advplyr/audiobookshelf/blob/d7b2476473...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.