CVE-2023-30626highCWE-22

Jellyfin vulnerable to directory traversal and file write causing arbitrary code execution

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 2.0%

probabilidad de explotación

2.0%top 21% de las CVE

explotación observada

noninguna fuente lo reporta

Jellyfin is a free-software media system. Versions starting with 10.8.0 and prior to 10.8.10 and prior have a directory traversal vulnerability inside the `ClientLogController`, specifically `/ClientLog/Document`. When combined with a cross-site scripting vulnerability (CVE-2023-30627), this can result in file write and arbitrary code execution. Version 10.8.10 has a patch for this issue. There are no known workarounds.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Productos afectados

jellyfin · jellyfin

Referencias

https://github.com/jellyfin/jellyfin/blob/22d880662283980dec994cd7d35fe269613bfce3/Jellyfin.Api/Controllers/ClientLogController.cs#L44 https://github.com/jellyfin/jellyfin/commit/82ad2633fdfb1c37a158057c7935f83e1129eda7 https://github.com/jellyfin/jellyfin/pull/5918 https://github.com/jellyfin/jellyfin/releases/tag/v10.8.10 https://github.com/jellyfin/jellyfin/security/advisories/GHSA-9p5f-5x8v-x65m https://github.com/jellyfin/jellyfin-web/security/advisories/GHSA-89hp-h43h-r5pq