CVE-2021-21399: Unauthenticated SubSonic backend access in Ampache
Ampache is a web based audio/video streaming application and file manager. Versions prior to 4.4.1 allow unauthenticated access to Ampache using the subsonic API. To successfully make the attack you must use a username that is not part of the site to bypass the auth checks. For more details and workaround guidance see the referenced GitHub security advisory.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-21399?
CVE-2021-21399 is a vulnerability in Ampache versions prior to 4.4.1 that allows unauthenticated access to Ampache using the subsonic API.
How severe is CVE-2021-21399?
CVE-2021-21399 has a severity rating of 7.5 (critical).
How does CVE-2021-21399 work?
CVE-2021-21399 allows attackers to bypass authentication checks by using a username that is not part of the site.
Which software versions are affected by CVE-2021-21399?
Ampache versions prior to 4.4.1 are affected by CVE-2021-21399.
How can I fix CVE-2021-21399?
To fix CVE-2021-21399, it is recommended to update Ampache to version 4.4.1 or later.