CVE-2024-41665: Ampache Stored Cross-site Scripting Vulnerability
Ampache, a web based audio/video streaming application and file manager, has a stored cross-site scripting (XSS) vulnerability in versions prior to 6.6.0. This vulnerability exists in the "Playlists - Democratic - Configure Democratic Playlist" feature. An attacker with Content Manager permissions can set the Name field to <svg onload=alert(8)>. When any administrator or user accesses the Democratic functionality, they will be affected by this stored XSS vulnerability. The attacker can exploit this vulnerability to obtain the cookies of any user or administrator who accesses the democratic.php file. Version 6.6.0 contains a patch for the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41665?
CVE-2024-41665 is categorized as a high severity stored cross-site scripting vulnerability.
How do I fix CVE-2024-41665?
To fix CVE-2024-41665, upgrade Ampache to version 6.6.0 or higher.
What versions of Ampache are affected by CVE-2024-41665?
CVE-2024-41665 affects all Ampache versions prior to 6.6.0.
What feature is vulnerable in CVE-2024-41665?
CVE-2024-41665 exposes a vulnerability in the 'Playlists - Democratic - Configure Democratic Playlist' feature.
Can CVE-2024-41665 be exploited by attackers?
Yes, attackers with content management privileges can exploit CVE-2024-41665 to execute arbitrary scripts.