CVE-2021-29490: Unauthenticated GET requests through Remote Image endpoints
Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. Verions prior to 10.7.3 vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the imageUrl parameter. This issue potentially exposes both internal and external HTTP servers or other resources available via HTTP GET that are visible from the Jellyfin server. The vulnerability is patched in version 10.7.3. As a workaround, disable external access to the API endpoints /Items//RemoteImages/Download, /Items/RemoteSearch/Image and /Images/Remote via reverse proxy, or limit to known-friendly IPs.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-29490?
CVE-2021-29490 is a vulnerability in Jellyfin that allows unauthenticated Server-Side Request Forgery (SSRF) attacks via the imageUrl parameter.
How severe is CVE-2021-29490?
CVE-2021-29490 has a severity score of 5.8, which is classified as medium.
How does CVE-2021-29490 impact Jellyfin?
CVE-2021-29490 exposes both internal and external resources, potentially leading to unauthorized access or data leakage.
Which versions of Jellyfin are affected by CVE-2021-29490?
Versions prior to 10.7.3 of Jellyfin are vulnerable to CVE-2021-29490.
How can I fix CVE-2021-29490 in Jellyfin?
To fix CVE-2021-29490, update Jellyfin to version 10.7.3 or newer.