CVE-2018-14691

An issue was discovered in Subsonic 6.1.1. The music tags feature is affected by three stored cross-site scripting vulnerabilities in the c0-param2, c0-param3, and c0-param4 parameters to dwr/call/plaincall/tagService.setTags.dwr that could be used to steal session information of a victim.
References
Configurations

Configuration 1 (hide)

cpe:2.3:a:subsonic:subsonic:6.1.1:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-09-21 16:29

Updated : 2024-02-28 16:48


NVD link : CVE-2018-14691

Mitre link : CVE-2018-14691

CVE.ORG link : CVE-2018-14691


JSON object : View

Products Affected

subsonic

  • subsonic
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')