2 lines
3.5 KiB
JSON
2 lines
3.5 KiB
JSON
{"affected":[{"affectedData":[{"product":"ampache","vendor":"ampache","versions":[{"status":"affected","version":"< 4.4.1"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ampache:ampache:*:*:*:*:*:*:*:*","matchCriteriaId":"B3DC4A36-61C8-4507-A2B2-17CD1351917C","versionEndExcluding":"4.4.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Ampache is a web based audio/video streaming application and file manager. Versions prior to 4.4.1 allow unauthenticated access to Ampache using the subsonic API. To successfully make the attack you must use a username that is not part of the site to bypass the auth checks. For more details and workaround guidance see the referenced GitHub security advisory."},{"lang":"es","value":"Ampache es una aplicación de transmisión de audio y video basada en la web y un administrador de archivos. Las versiones anteriores a 4.4.1 permiten el acceso no autenticado a Ampache usando la API subsonic. Para realizar el ataque con éxito, debe utilizar un nombre de usuario que no forme parte del sitio para omitir las comprobaciones de autenticación. Para obtener más detalles y una guía de solución alternativa, consulte el aviso de seguridad de GitHub al que se hace referencia"}],"id":"CVE-2021-21399","lastModified":"2026-06-17T03:35:29.393","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"NONE","baseScore":5.0,"confidentialityImpact":"PARTIAL","integrityImpact":"NONE","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","version":"2.0"},"exploitabilityScore":10.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2021-04-13T20:15:14.843","references":[{"source":"security-advisories@github.com","tags":["Exploit","Mitigation","Third Party Advisory"],"url":"https://github.com/ampache/ampache/security/advisories/GHSA-p9pm-j95j-5mjf"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Mitigation","Third Party Advisory"],"url":"https://github.com/ampache/ampache/security/advisories/GHSA-p9pm-j95j-5mjf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"security-advisories@github.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-287"}],"source":"nvd@nist.gov","type":"Primary"}]}
|