CVE-2021-32644CWE-79

Cross-site Scripting in Random.php

Medium · published June 22, 2021

CVSS v3.1
6.4
EPSS
1%
Percentile
57.6
In the wild
Unconfirmed
What it is

Ampache is an open source web based audio/video streaming application and file manager. Due to a lack of input filtering versions 4.x.y are vulnerable to code injection in random.php. The attack requires user authentication to access the random.php page unless the site is running in demo mode. This issue has been resolved in 4.4.3.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00843 · 57.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-06-22T17:45Z
EPSS history
Timeline
  • 22 JUN 17:45Z
    Cross-site Scripting in Random.php
    cvelistv5