CVE-2019-12386: XSS
An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay "add instance" functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to create a new privileged user whose credentials are known by the attacker.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-12386?
CVE-2019-12386 has a medium severity rating due to its potential for exploitation through stored XSS.
How do I fix CVE-2019-12386?
To fix CVE-2019-12386, upgrade Ampache to version 3.9.2 or later, which addresses the stored XSS vulnerability.
What impact does CVE-2019-12386 have on users?
CVE-2019-12386 allows injection of malicious scripts that can compromise user accounts, especially targeting admin users.
Which versions of Ampache are affected by CVE-2019-12386?
CVE-2019-12386 affects Ampache versions up to and including 3.9.1.
Is there a workaround for CVE-2019-12386?
A practical workaround for CVE-2019-12386 includes restricting access to the LocalPlay functionality for untrusted users.