Kurz gesagt
- CVE-2024-56362 ist eine Schwachstelle (MITTEL (CVSS 5.5)) in github.com/navidrome/navidrome, navidrome (navidrome).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.15%, höher als bei 4.5% aller Schwachstellen.
- Abhilfe: auf 0.54.1 oder neuer aktualisieren.
Description
Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret.
The JWT secret is critical for the authentication and authorization system. If exposed, an attacker could:
- Forge valid tokens to impersonate users, including administrative accounts.
- Gain unauthorized access to sensitive data or perform privileged actions.
This vulnerability has been tested on the latest version of Navidrome and poses a significant risk in environments where the database file is not adequately secured.
NVD description
Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. This vulnerability is fixed in 0.54.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free