CVE-2024-51485 Insufficient Validation in Plugins (Activation/Deactivation) in Ampache

What is CVE-2024-51485?

CVE-2024-51485 is a medium-severity vulnerability in ampache, published on 11 Nov 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens when activating or deactivating plugins. This vulnerability allows an attacker to exploit CSRF attacks, potentially enabling them to change website features that should only be managed by administrators through malicious requests. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-352

Which versions are affected by CVE-2024-51485?

It affects 1 product.

Products include Ampache Ampache.

How do I fix CVE-2024-51485?

No fix has been published for CVE-2024-51485 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-51485 being exploited?

There is no known exploitation of CVE-2024-51485 in the wild and no public exploit code.

Other vulnerabilities in ampache

• CVE-2023-0606 Cross-site Scripting (XSS) - Reflected in ampache/ampache Critical 9.3
• CVE-2021-21399 Unauthenticated SubSonic backend access in Ampache Critical 9.1
• CVE-2019-12385 SQL injection in n/a High 8.8
• CVE-2017-18375 Deserialization in n/a High 8.8
• CVE-2020-15153 Unauthenticated SQL injection in Ampache High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xvfj-w962-hqcx, UBUNTU-CVE-2024-51485.