CVE-2024-28853: Ampache Stored XSS
Ampache is a web based audio/video streaming application and file manager. Stored Cross Site Scripting (XSS) vulnerability in ampache before v6.3.1 allows a remote attacker to execute code via a crafted payload to serval parameters in the post request of /preferences.php?action=adminupdatepreferences. This vulnerability is fixed in 6.3.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ampacheto a version that resolves this vulnerability.Fixed in 6.3.1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28853?
CVE-2024-28853 is classified as a Stored Cross Site Scripting (XSS) vulnerability that could allow remote code execution.
How do I fix CVE-2024-28853?
To fix CVE-2024-28853, upgrade Ampache to version 6.3.1 or later.
What versions of Ampache are affected by CVE-2024-28853?
CVE-2024-28853 affects all versions of Ampache prior to 6.3.1.
What components of Ampache are vulnerable in CVE-2024-28853?
The vulnerability in CVE-2024-28853 specifically affects the parameters in the POST request made to /preferences.php?action=admin.
Can CVE-2024-28853 be exploited remotely?
Yes, CVE-2024-28853 can be exploited remotely by an attacker using a crafted payload.