CVE-2024-28852: Ampache has multiple reflective XSS vulnerabilities
Ampache is a web based audio/video streaming application and file manager. Ampache has multiple reflective XSS vulnerabilities,this means that all forms in the Ampache that use rule as a variable are not secure. For example, when querying a song, when querying a podcast, we need to use $rule variable. This vulnerability is fixed in 6.3.1
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ampacheto a version that resolves this vulnerability.Fixed in 6.3.1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28852?
CVE-2024-28852 has a moderate severity level due to its potential for reflective XSS attacks.
How do I fix CVE-2024-28852?
To mitigate CVE-2024-28852, update Ampache to version 6.3.1 or later, ensuring secure handling of the 'rule' variable in forms.
What software is affected by CVE-2024-28852?
CVE-2024-28852 affects Ampache versions prior to 6.3.1.
What types of vulnerabilities are present in CVE-2024-28852?
CVE-2024-28852 includes multiple reflective XSS vulnerabilities.
Can CVE-2024-28852 lead to data exposure?
Yes, CVE-2024-28852 can potentially allow attackers to execute scripts in users' browsers, leading to data exposure.