Subsonic 6.1.1 vulnerabilities

Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the authentication of users for requests such as subscribing to a podcast or updating Internet Radio Settings.

The CSRF vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack user authentication for password changes via a crafted request to userSettings.view.

CVE-2017-9355 is an XXE vulnerability in the import playlist feature in Subsonic 6.1.1 that may allow remote attackers to conduct SSRF attacks via a crafted XSPF playlist file.