{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2019-08-21T00:00:00", "descriptions": [{"lang": "en", "value": "An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay \"add instance\" functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to create a new privileged user whose credentials are known by the attacker."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-11-11T15:06:36", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.tarlogic.com/en/blog/vulnerabilities-in-ampache/"}, {"name": "[debian-lts-announce] 20191111 [SECURITY] [DLA 1988-1] ampache security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00008.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-12386", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay \"add instance\" functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to create a new privileged user whose credentials are known by the attacker."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://www.tarlogic.com/en/blog/vulnerabilities-in-ampache/", "refsource": "MISC", "url": "https://www.tarlogic.com/en/blog/vulnerabilities-in-ampache/"}, {"name": "[debian-lts-announce] 20191111 [SECURITY] [DLA 1988-1] ampache security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00008.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T23:17:39.984Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.tarlogic.com/en/blog/vulnerabilities-in-ampache/"}, {"name": "[debian-lts-announce] 20191111 [SECURITY] [DLA 1988-1] ampache security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00008.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-12386", "datePublished": "2019-08-22T18:21:04", "dateReserved": "2019-05-28T00:00:00", "dateUpdated": "2024-08-04T23:17:39.984Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ampache:ampache:*:*:*:*:*:*:*:*", "matchCriteriaId": "FD3B3D4F-E3B3-42B2-B940-645CAE4CA38D", "versionEndIncluding": "3.9.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay \"add instance\" functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to create a new privileged user whose credentials are known by the attacker."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Ampache versiones hasta 3.9.1. Se presenta una vulnerabilidad de tipo XSS almacenado en la funcionalidad LocalPlay \"add instance\" del archivo localplay.php. El c\u00f3digo inyectado se refleja en el men\u00fa de instancias. Esta vulnerabilidad puede ser abusada para forzar a un administrador a crear un nuevo usuario privilegiado cuyas credenciales sean conocidas por el atacante."}], "id": "CVE-2019-12386", "lastModified": "2024-11-21T04:22:43.763", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-08-22T19:15:14.330", "references": [{"source": "cve@mitre.org", "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00008.html"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.tarlogic.com/en/blog/vulnerabilities-in-ampache/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00008.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.tarlogic.com/en/blog/vulnerabilities-in-ampache/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}