CVE-2023-30627: jellyfin-web has a stored cross-site scripting vulnerability in devices.js
jellyfin-web is the web client for Jellyfin, a free-software media system. Starting in version 10.1.0 and prior to version 10.8.10, a stored cross-site scripting vulnerability in device.js can be used to make arbitrary calls to the REST endpoints with admin privileges. When combined with CVE-2023-30626, this results in remote code execution on the Jellyfin instance in the context of the user who's running it. This issue is patched in version 10.8.10. There are no known workarounds.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-30627?
CVE-2023-30627 is a stored cross-site scripting vulnerability in the device.js file of jellyfin-web, allowing arbitrary calls to REST endpoints with admin privileges.
What is the severity of CVE-2023-30627?
The severity of CVE-2023-30627 is critical with a CVSS score of 5.4.
How can the CVE-2023-30627 vulnerability be exploited?
The CVE-2023-30627 vulnerability can be exploited by an attacker injecting malicious code into the device.js file, enabling them to make unauthorized calls to REST endpoints with admin privileges.
What versions of Jellyfin are affected by CVE-2023-30627?
Jellyfin versions 10.1.0 to 10.8.10 are affected by CVE-2023-30627.
How can I fix the CVE-2023-30627 vulnerability?
To fix the CVE-2023-30627 vulnerability, update jellyfin-web to version 10.8.10 or later.