Stored Cross-Site Scripting in Ampache Streaming Application
CVE-2024-47184

4.8MEDIUM

Key Information:

Vendor

Ampache

Status
Ampache
Vendor
CVE Published:
27 September 2024

What is CVE-2024-47184?

Ampache, a popular web-based audio and video streaming application, has a significant vulnerability in the Democratic Playlist Name feature. This flaw allows attackers to exploit stored cross-site scripting in versions prior to 6.6.0. The vulnerability could enable unauthorized scripts to be executed in the context of users' sessions, potentially leading to data theft or manipulation. Users are strongly encouraged to update to version 6.6.0, where this issue has been addressed.

References

https://github.com/ampache/ampache/security/advisories/GH...
https://github.com/ampache/ampache/commit/7e64d140dafcbe0...
https://github.com/ampache/ampache/blob/ff332c9810e493fd5...

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.
CVE-2024-47184 : Stored Cross-Site Scripting in Ampache Streaming Application