Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2023-23636

In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage of the victim.

VectorNETWORK

PublishedFeb 03, 2023, 01:15

Published Bycve@mitre.org

Base Score

Score5.4

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

jellyfin-web(npm)10.8.010.8.4N/A

References

https://github.com/jellyfin/jellyfin-web/issues/3788
https://herolab.usd.de/security-advisories/
https://herolab.usd.de/security-advisories/usd-2022-0030/

Weakness Type

CWE-79

CVSS Metrics

Base Score

5.4

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK