← back
CVE-2017-9414

CVE-2017-9414

EPSS 15.7%
Cross-site request forgery (CSRF) vulnerability in the Subscribe to Podcast feature in Subsonic 6.1.1 allows remote attackers to hijack the authentication of unspecified victims for requests that conduct cross-site scripting (XSS) attacks or possibly have unspecified other impact via the name parameter to playerSettings.view.
Affected products
n/a · n/a
public PoCs found — 3
cve_referencepacketstormsecurity.com/files/142796/Subsonic-6.1.1-Persistent-XSS.htmlunverifiedcve_referencewww.exploit-db.com/exploits/42120/unverifiedexploitdbwww.exploit-db.com/exploits/42120unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://hyp3rlinx.altervista.org/advisories/SUBSONIC-CSRF-PERSISTENT-XSS.txthttp://packetstormsecurity.com/files/142796/Subsonic-6.1.1-Persistent-XSS.htmlhttps://www.exploit-db.com/exploits/42120/