CVE-2017-9355
HighSummary
CVE-2017-9355 is an XXE vulnerability in the import playlist feature in Subsonic 6.1.1 that may allow remote attackers to conduct SSRF attacks via a crafted XSPF playlist file.
Risk Assessment
An attacker could exploit this vulnerability to perform server-side attacks, potentially leading to the exposure of sensitive data or system compromise.
Recommendation
It is recommended to update Subsonic to the latest version to mitigate this vulnerability and implement appropriate safeguards against SSRF attacks.
Other vulnerabilities in Subsonic 6.1.1
See all- CVE-2017-9413High
Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the authentication of users for requests such as subscribing to a podcast or updating Internet Radio Settings.
- CVE-2017-9415High
The CSRF vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack user authentication for password changes via a crafted request to userSettings.view.
Original NVD description (English source)
XML external entity (XXE) vulnerability in the import playlist feature in Subsonic 6.1.1 might allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted XSPF playlist file.