CVE-2024-51488 Insufficient Validation in Delete Message in Ampache

What is CVE-2024-51488?

CVE-2024-51488 is a medium-severity vulnerability in ampache, published on 11 Nov 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing does not adequately validate CSRF tokens when users delete messages. This vulnerability could be exploited to forge CSRF attacks, allowing an attacker to delete messages to any user, including administrators, if they interact with a malicious request. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-352

Which versions are affected by CVE-2024-51488?

It affects 1 product.

Products include Ampache Ampache.

How do I fix CVE-2024-51488?

No fix has been published for CVE-2024-51488 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-51488 being exploited?

There is no known exploitation of CVE-2024-51488 in the wild and no public exploit code.

Other vulnerabilities in ampache

• CVE-2023-0606 Cross-site Scripting (XSS) - Reflected in ampache/ampache Critical 9.3
• CVE-2021-21399 Unauthenticated SubSonic backend access in Ampache Critical 9.1
• CVE-2019-12385 SQL injection in n/a High 8.8
• CVE-2017-18375 Deserialization in n/a High 8.8
• CVE-2020-15153 Unauthenticated SQL injection in Ampache High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-46m4-5pxj-66f2, UBUNTU-CVE-2024-51488.