CVE-2017-9413
HighSummary
Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the authentication of users for requests such as subscribing to a podcast or updating Internet Radio Settings.
Risk Assessment
Attackers can exploit these vulnerabilities to conduct server-side request forgery (SSRF) attacks, potentially leading to unauthorized access to server resources.
Recommendation
It is recommended to update to the latest version of Subsonic to mitigate these vulnerabilities and implement additional security measures against CSRF.
Other vulnerabilities in Subsonic 6.1.1
See all- CVE-2017-9415High
The CSRF vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack user authentication for password changes via a crafted request to userSettings.view.
- CVE-2017-9355High
CVE-2017-9355 is an XXE vulnerability in the import playlist feature in Subsonic 6.1.1 that may allow remote attackers to conduct SSRF attacks via a crafted XSPF playlist file.
Original NVD description (English source)
Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the authentication of users for requests that (1) subscribe to a podcast via the add parameter to podcastReceiverAdmin.view or (2) update Internet Radio Settings via the urlRedirectCustomUrl parameter to networkSettings.view. NOTE: These vulnerabilities can be exploited to conduct server-side request forgery (SSRF) attacks.