GHSA-qwp3-5fw3-5wgv

Incorrect Access Control and Cross Site Scripting in Jellyfin

Source: GitHub Advisory Database (reviewed) High CVE-2022-35909

Packages

Ecosystem	Package	Affected	Fixed in
NuGet	Jellyfin.Common	< 10.8.0	10.8.0

Details

As written in the advisory (Markdown source, shown as plain text).

In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality. This lack of access control can be leveraged to performe a cross site scripting attack.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-35909 advisory
https://github.com/jellyfin/jellyfin/pull/7569/files web
https://docs.google.com/document/d/1cBXQrokCvWxKET4BKi3ZLtVp5gst6-MrGPgMKpfXw8Y/edit web
https://github.com/jellyfin/jellyfin package
https://medium.com/stolabs/cve-2022-35909-cve-2022-35910-incorrect-access-control-and-xss-stored-to-jellyfin-967359c91058 web