CVE-2024-51487: Insufficient Validation in Catalog (Activation/Deactivation) in Ampache
Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens when activating or deactivating catalog. This vulnerability allows an attacker to exploit CSRF attacks, potentially enabling them to change website features that should only be managed by administrators through malicious requests. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-51487?
CVE-2024-51487 has been rated as a medium severity vulnerability due to its potential impact on user sessions through CSRF attacks.
How do I fix CVE-2024-51487?
To fix CVE-2024-51487, update the Ampache application to the latest version, ensuring proper CSRF token validation is implemented.
Which versions of Ampache are affected by CVE-2024-51487?
CVE-2024-51487 affects Ampache version 7.0.0.
What type of vulnerability is CVE-2024-51487?
CVE-2024-51487 is a Cross-Site Request Forgery (CSRF) vulnerability.
What are the consequences of exploiting CVE-2024-51487?
Exploitation of CVE-2024-51487 could allow an attacker to activate or deactivate catalogs without user consent.