CVE-2024-51489 Insufficient Message Token Validation in Ampache

What is CVE-2024-51489?

CVE-2024-51489 is a medium-severity vulnerability in ampache, published on 11 Nov 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing does not adequately validate CSRF tokens when users send messages to one another. This vulnerability could be exploited to forge CSRF attacks, allowing an attacker to send messages to any user, including administrators, if they interact with a malicious request. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-352

Which versions are affected by CVE-2024-51489?

It affects 1 product.

Products include Ampache Ampache.

How do I fix CVE-2024-51489?

No fix has been published for CVE-2024-51489 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-51489 being exploited?

There is no known exploitation of CVE-2024-51489 in the wild and no public exploit code.

Other vulnerabilities in ampache

• CVE-2023-0606 Cross-site Scripting (XSS) - Reflected in ampache/ampache Critical 9.3
• CVE-2021-21399 Unauthenticated SubSonic backend access in Ampache Critical 9.1
• CVE-2019-12385 SQL injection in n/a High 8.8
• CVE-2017-18375 Deserialization in n/a High 8.8
• CVE-2020-15153 Unauthenticated SQL injection in Ampache High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4q69-983r-mwwr, UBUNTU-CVE-2024-51489.