CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

CVE details

CVE-2024-47828

ampache is a web based audio/video streaming application and file manager. A CSRF attack can be performed in order to delete objects (Playlist, smartlist etc.). Cross-Site Request Forgery (CSRF) is an attack that forces authenticated users to submit a request to a Web application against which they are currently authenticated. This vulnerability can be exploited by creating a malicious script with an arbitrary playlist ID belonging to another user. When the user submits the request, their playlist will be deleted. Any User with active sessions who are tricked into submitting a malicious request are impacted, as their playlists or other objects could be deleted without their consent.

Score
5.3 medium
Published
2024-10-09
Links
NVD · cve.org

Affected ports (5)

PortPackageVersionStatusMaintainer
audio/ampacheampache-php825.6.0_1unaddressedcrees@FreeBSD.org
audio/ampacheampache-php835.6.0_1unaddressedcrees@FreeBSD.org
audio/ampacheampache-php845.6.0_1unaddressedcrees@FreeBSD.org
audio/ampacheampache-php855.6.0_1unaddressedcrees@FreeBSD.org
audio/ampacheampache-php865.6.0_1unaddressedcrees@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>ampache-php82</name>
	<range><lt>FIXME</lt></range>
      </package>
      <package>
	<name>ampache-php83</name>
	<range><lt>FIXME</lt></range>
      </package>
      <package>
	<name>ampache-php84</name>
	<range><lt>FIXME</lt></range>
      </package>
      <package>
	<name>ampache-php85</name>
	<range><lt>FIXME</lt></range>
      </package>
      <package>
	<name>ampache-php86</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>ampache is a web based audio/video streaming application and file
	manager. A CSRF attack can be performed in order to delete objects
	(Playlist, smartlist etc.). Cross-Site Request Forgery (CSRF) is an
	attack that forces authenticated users to submit a request to a Web
	application against which they are currently authenticated. This
	vulnerability can be exploited by creating a malicious script with an
	arbitrary playlist ID belonging to another user. When the user submits
	the request, their playlist will be deleted. Any User with active
	sessions who are tricked into submitting a malicious request are
	impacted, as their playlists or other objects could be deleted without
	their consent.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2024-47828</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2024-47828</url>
    </references>
    <dates>
      <discovery>2024-10-09</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>