CVE-2017-16568: XSS
Cross-site scripting (XSS) vulnerability in Logitech Media Server 7.9.0 allows remote attackers to inject arbitrary web script or HTML via a radio URL.
Other sources
Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Radio" functionality. This vulnerability allows attackers to inject malicious JavaScript payloads, which become permanently stored on the server and execute when a user plays the compromised radio stream. Exploitation of this vulnerability can lead to Session hijacking and unauthorized access, Persistent manipulation of web content within the application, and Phishing or malicious redirects to external domains. This vulnerability can be exploited to manipulate media server behavior in enterprise and home network environments.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-16568?
The severity of CVE-2017-16568 is rated as high due to its potential for enabling remote attackers to execute malicious scripts.
How do I fix CVE-2017-16568?
To fix CVE-2017-16568, upgrade to a version of Logitech Media Server that is not affected by this vulnerability, as version 7.9.0 contains the issue.
What are the potential impacts of CVE-2017-16568?
The potential impacts of CVE-2017-16568 include unauthorized access to sensitive user information and the ability to perform actions on behalf of the user.
Who is affected by CVE-2017-16568?
Anyone using Logitech Media Server version 7.9.0 is at risk and should take immediate action to mitigate the vulnerability.
What type of vulnerability is CVE-2017-16568?
CVE-2017-16568 is classified as a persistent cross-site scripting (XSS) vulnerability.