CVE-2022-26505: High severity readymedia vulnerability
A DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1 allows a remote web server to exfiltrate media files.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue in ReadyMedia?
The vulnerability ID for this issue in ReadyMedia is CVE-2022-26505.
What is the description of CVE-2022-26505?
CVE-2022-26505 is a DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1 that allows a remote web server to exfiltrate media files.
Which software versions are affected by CVE-2022-26505?
The affected software versions of CVE-2022-26505 include ReadyMedia (formerly MiniDLNA) versions 1.2.1+dfsg-2+deb10u3, 1.2.1+dfsg-2+deb10u4, 1.3.0+dfsg-2+deb11u1, 1.3.0+dfsg-2+deb11u2, 1.3.0+dfsg-2.2+deb12u1, and 1.3.3+dfsg-0.1.
How can a remote web server exploit CVE-2022-26505?
A remote web server can exploit CVE-2022-26505 through a DNS rebinding attack to exfiltrate media files.
Are there any remedies available for CVE-2022-26505?
Yes, there are remedies available for CVE-2022-26505, including specific package versions provided by Debian and Ubuntu.