CVE-2023-48702: GHSL-2023-028: Remote Code Execution in jellyfin - CVE-2023-48702
A user with administrator permissions is able to run arbitrary code on the jellyfin server via the /System/MediaEncoder/Path endpoint.
Other sources
Jellyfin is a system for managing and streaming media. Prior to version 10.8.13, the /System/MediaEncoder/Path endpoint executes an arbitrary file using ProcessStartInfo via the ValidateVersion function. A malicious administrator can setup a network share and supply a UNC path to /System/MediaEncoder/Path which points to an executable on the network share, causing Jellyfin server to run the executable in the local context. The endpoint was removed in version 10.8.13.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-48702?
CVE-2023-48702 is considered to have a high severity due to the potential for arbitrary file execution by a malicious administrator.
How do I fix CVE-2023-48702?
To remediate CVE-2023-48702, upgrade Jellyfin to version 10.8.13 or later.
What systems are affected by CVE-2023-48702?
CVE-2023-48702 affects Jellyfin versions prior to 10.8.13.
Can CVE-2023-48702 be exploited remotely?
CVE-2023-48702 requires local administrative access to exploit, potentially limiting remote exploitation.
What is the impact of CVE-2023-48702?
The impact of CVE-2023-48702 includes the risk of arbitrary code execution which can compromise system integrity.