CVE-2017-9415
HighSummary
The CSRF vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack user authentication for password changes via a crafted request to userSettings.view.
Risk Assessment
Attackers can exploit this vulnerability to unauthorizedly change user passwords, potentially leading to loss of control over accounts.
Recommendation
It is recommended to implement CSRF protection mechanisms and update to the latest version of subsonic to minimize risk.
Other vulnerabilities in subsonic 6.1.1
See all- CVE-2017-9413High
Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the authentication of users for requests such as subscribing to a podcast or updating Internet Radio Settings.
- CVE-2017-9355High
CVE-2017-9355 is an XXE vulnerability in the import playlist feature in Subsonic 6.1.1 that may allow remote attackers to conduct SSRF attacks via a crafted XSPF playlist file.
Original NVD description (English source)
Cross-site request forgery (CSRF) vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack the authentication of users for requests that change passwords via a crafted request to userSettings.view.