CVE-2024-51486: Stored Cross-Site Scripting in Ampache
Ampache is a web based audio/video streaming application and file manager. The vulnerability exists in the interface section of the Ampache menu, where users can change the "Custom URL - Favicon". This section is not properly sanitized, allowing for the input of strings that can execute JavaScript. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Other sources
Ampache is a web based audio/video streaming application and file manager. The vulnerability exists in the interface section of the Ampache menu, where users can change the "Custom URL?-?Favicon". This section is not properly sanitized, allowing for the input of strings that can execute JavaScript. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-51486?
CVE-2024-51486 has been classified with a high severity due to improper input sanitization leading to potential code execution.
How do I fix CVE-2024-51486?
To fix CVE-2024-51486, update Ampache to version 7.0.1 or later where the vulnerability has been addressed.
What systems are affected by CVE-2024-51486?
CVE-2024-51486 affects Ampache version 7.0.0.
What kind of attacks can CVE-2024-51486 facilitate?
CVE-2024-51486 can facilitate arbitrary code execution attacks due to the lack of input sanitization.
Is CVE-2024-51486 exploitable without authentication?
Yes, CVE-2024-51486 is exploitable by unauthenticated users as it is related to a publicly accessible feature.