CVE-2024-51487mediumCWE-352

CVE-2024-51487: medium-severity vulnerability in ampache

Insufficient Validation in Catalog (Activation/Deactivation) in Ampache

Published · Updated

Follow this CVE+ Monitor ampache

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.4%
Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens when activating or deactivating catalog. This vulnerability allows an attacker to exploit CSRF attacks, potentially enabling them to change website features that should only be managed by administrators through malicious requests. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
ampache · ampache
Related CVEs — ampache

In the same product, most dangerous first.

CVE-2020-15153HIGHUnauthenticated SQL injection in AmpacheEPSS 2.4%CVE-2021-21399CRITICALUnauthenticated SubSonic backend access in AmpacheEPSS 1.4%CVE-2021-32644MEDIUMCross-site Scripting in Random.phpEPSS 0.8%CVE-2024-28853LOWAmpache Stored XSSEPSS 0.6%CVE-2024-47184MEDIUMAmpache vulnerable to Stored XSS via Democratic Playlist NameEPSS 0.5%CVE-2024-51490MEDIUMStored Cross-Site Scripting in AmpacheEPSS 0.5%