CVE-2021-32644: Cross-site Scripting in Random.php

Published Jun 22, 2021

Updated

Ampache is an open source web based audio/video streaming application and file manager. Due to a lack of input filtering versions 4.x.y are vulnerable to code injection in random.php. The attack requires user authentication to access the random.php page unless the site is running in demo mode. This issue has been resolved in 4.4.3.

Affected Software

1 affected component

Ampache Ampache=4.4.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Ampache to a version that resolves this vulnerability.
Fixed in 4.4.3

Event History

Jun 22, 2021

CVE Published

via MITRE·05:45 PM

Data Sourced

via MITRE·05:45 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2021-32644?

CVE-2021-32644 is rated as a medium severity vulnerability due to potential code injection risks.

How do I fix CVE-2021-32644?

To fix CVE-2021-32644, upgrade to a patched version of Ampache or implement input filtering for the random.php page.

Which versions of Ampache are affected by CVE-2021-32644?

CVE-2021-32644 affects Ampache versions 4.x.y, notably including version 4.4.2.

What kind of attack is possible with CVE-2021-32644?

CVE-2021-32644 allows for code injection attacks if proper input validation is not in place.

Is user authentication required to exploit CVE-2021-32644?

Yes, user authentication is required to access the vulnerable random.php page in CVE-2021-32644.