CVE-2021-29490
See a problem?- Source
- https://nvd.nist.gov/vuln/detail/CVE-2021-29490
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-29490.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2021-29490
- Aliases
-
- GHSA-rgjw-4fwc-9v96
- Published
- 2021-05-06T13:15:12Z
- Modified
- 2024-09-03T03:48:05.766550Z
- Severity
-
- 5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. Verions prior to 10.7.3 vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the imageUrl parameter. This issue potentially exposes both internal and external HTTP servers or other resources available via HTTP
GETthat are visible from the Jellyfin server. The vulnerability is patched in version 10.7.3. As a workaround, disable external access to the API endpoints/Items/*/RemoteImages/Download,/Items/RemoteSearch/Imageand/Images/Remotevia reverse proxy, or limit to known-friendly IPs. - References