CVE-2023-30627
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-30627
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-30627.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2023-30627
- Aliases
-
- CVE-2023-30626
- GHSA-89hp-h43h-r5pq
- GHSA-9p5f-5x8v-x65m
- Published
- 2023-04-24T21:15:09Z
- Modified
- 2024-10-12T10:53:48.569888Z
- Severity
-
- 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
jellyfin-web is the web client for Jellyfin, a free-software media system. Starting in version 10.1.0 and prior to version 10.8.10, a stored cross-site scripting vulnerability in device.js can be used to make arbitrary calls to the
RESTendpoints with admin privileges. When combined with CVE-2023-30626, this results in remote code execution on the Jellyfin instance in the context of the user who's running it. This issue is patched in version 10.8.10. There are no known workarounds. - References
-
- https://github.com/jellyfin/jellyfin-web/security/advisories/GHSA-89hp-h43h-r5pq
- https://github.com/jellyfin/jellyfin/security/advisories/GHSA-9p5f-5x8v-x65m
- https://github.com/jellyfin/jellyfin-web/commit/b88a5951e1a517ff4c820e693d9c0da981cf68ee
- https://github.com/jellyfin/jellyfin-web/releases/tag/v10.8.10
Affected packages
Git / github.com/jellyfin/jellyfin-web
Affected ranges
- Type
- GIT
- Repo
- https://github.com/jellyfin/jellyfin-web
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
v10.*
v10.0.0
v10.0.1
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.3.0-rc1
v10.3.0-rc2
v10.3.1
v10.3.2
v10.3.3
v10.3.4
v10.3.5
v10.3.6
v10.3.7
v10.4.0
v10.5.0
v10.6.0
v10.8.0
v10.8.0-alpha1
v10.8.0-alpha2
v10.8.0-alpha3
v10.8.0-alpha4
v10.8.0-alpha5
v10.8.0-beta1
v10.8.0-beta2
v10.8.0-beta3
v10.8.1
v10.8.2
v10.8.3
v10.8.4
v10.8.5
v10.8.6
v10.8.7
v10.8.8
v10.8.9
v3.*
v3.5.2-3
v3.5.2-4
v3.5.2-5