CVE-2024-47828: Cross-Site Request Forgery in ampache
ampache is a web based audio/video streaming application and file manager. A CSRF attack can be performed in order to delete objects (Playlist, smartlist etc.). Cross-Site Request Forgery (CSRF) is an attack that forces authenticated users to submit a request to a Web application against which they are currently authenticated. This vulnerability can be exploited by creating a malicious script with an arbitrary playlist ID belonging to another user. When the user submits the request, their playlist will be deleted. Any User with active sessions who are tricked into submitting a malicious request are impacted, as their playlists or other objects could be deleted without their consent.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47828?
CVE-2024-47828 has a medium severity rating due to its ability to allow unauthorized deletion of user-created objects.
How do I fix CVE-2024-47828?
To fix CVE-2024-47828, you should update Ampache to version 6.6.1 or later to mitigate the CSRF vulnerability.
What types of objects are affected by CVE-2024-47828?
CVE-2024-47828 affects the deletion of objects such as playlists and smartlists within the Ampache application.
Who is vulnerable to CVE-2024-47828?
Any user of Ampache versions up to 6.6.0 is vulnerable to CVE-2024-47828 if they are authenticated.
How can I identify if I am impacted by CVE-2024-47828?
You can identify if you are impacted by CVE-2024-47828 by checking if you are using Ampache version 6.6.0 or earlier.