CVE-2024-51488: Insufficient Validation in Delete Message in Ampache
Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing does not adequately validate CSRF tokens when users delete messages. This vulnerability could be exploited to forge CSRF attacks, allowing an attacker to delete messages to any user, including administrators, if they interact with a malicious request. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-51488?
CVE-2024-51488 is rated as a medium severity vulnerability due to its potential for CSRF attacks.
How do I fix CVE-2024-51488?
To mitigate CVE-2024-51488, ensure that CSRF tokens are properly validated when processing delete requests in Ampache.
What software versions are affected by CVE-2024-51488?
CVE-2024-51488 affects Ampache version 7.0.0 specifically.
What type of attack does CVE-2024-51488 allow?
CVE-2024-51488 allows attackers to perform CSRF attacks, potentially leading to the deletion of user messages.
Is there a patch available for CVE-2024-51488?
As of now, there is no public patch for CVE-2024-51488, so it's advisable to follow best security practices until a fix is released.