What is GHSA-qwp3-5fw3-5wgv?

GHSA-qwp3-5fw3-5wgv is a security advisory published by GitHub Security Advisories with High severity. Incorrect Access Control and Cross Site Scripting in Jellyfin

Which CVE IDs does GHSA-qwp3-5fw3-5wgv cover?

GHSA-qwp3-5fw3-5wgv covers the following CVE IDs: CVE-2022-35909. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qwp3-5fw3-5wgv?

GHSA-qwp3-5fw3-5wgv has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-qwp3-5fw3-5wgv?

GHSA-qwp3-5fw3-5wgv affects 1 product, including: nuget/Jellyfin.Common:\u003c 10.8.0.

GHSA-qwp3-5fw3-5wgvHighCVSS 8.8

Incorrect Access Control and Cross Site Scripting in Jellyfin

Vendor

GitHub Security Advisories

Published

August 20, 2022

Last Modified

January 28, 2023

🔗 CVE IDs covered (1)

CVE-2022-35909 →

📋 Description

In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality. This lack of access control can be leveraged to performe a cross site scripting attack.

🎯 Affected products1

nuget/Jellyfin.Common:< 10.8.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2022-35909
https://github.com/jellyfin/jellyfin/pull/7569/files
https://docs.google.com/document/d/1cBXQrokCvWxKET4BKi3ZLtVp5gst6-MrGPgMKpfXw8Y/edit
https://medium.com/stolabs/cve-2022-35909-cve-2022-35910-incorrect-access-control-and-xss-stored-to-jellyfin-967359c91058
https://github.com/advisories/GHSA-qwp3-5fw3-5wgv