CVE-2019-8389

HIGH 8.1CVE-2019-8389 · Published 17/02/2019 · updated 17/06/2026

In short

CVE-2019-8389 is a HIGH (CVSS 8.1) vulnerability affecting musicloud (musicloud project).
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 73.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
musicloud musicloud_project	`= 1.6`	No fix yet

Description

A file-read vulnerability was identified in the Wi-Fi transfer feature of Musicloud 1.6. By default, the application runs a transfer service on port 8080, accessible by everyone on the same Wi-Fi network. An attacker can send the POST parameters downfiles and cur-folder (with a crafted ../ payload) to the download.script endpoint. This will create a MusicPlayerArchive.zip archive that is publicly accessible and includes the content of any requested file (such as the /etc/passwd file).

References

gist.github.com/shawarkhanethicalhacker/b98c5ac7491cf77732c793ecc468f465 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free