CVE-2017-9413

Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the authentication of…

published July 25, 2017

CVSS
—
EPSS
2%
Percentile
78.0
In the wild
Unconfirmed
What it is

Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the authentication of users for requests that (1) subscribe to a podcast via the add parameter to podcastReceiverAdmin.view or (2) update Internet Radio Settings via the urlRedirectCustomUrl parameter to networkSettings.view. NOTE: These vulnerabilities can be exploited to conduct server-side request forgery (SSRF) attacks.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01776 · 78.0th percentile
Published
2017-07-25T18:00Z
EPSS history
Timeline
  • 25 JUL 18:00Z
    Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the authentication of…
    cvelistv5