要点
- CVE-2024-56362 は github.com/navidrome/navidrome, navidrome (navidrome) に影響する深刻度「中」 (CVSS 5.5) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：0.15%（全脆弱性の 4.5% より高い）。
- 対処：0.54.1 以降に更新してください。
概要
Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret.
The JWT secret is critical for the authentication and authorization system. If exposed, an attacker could:
- Forge valid tokens to impersonate users, including administrative accounts.
- Gain unauthorized access to sensitive data or perform privileged actions.
This vulnerability has been tested on the latest version of Navidrome and poses a significant risk in environments where the database file is not adequately secured.
NVD の説明
Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. This vulnerability is fixed in 0.54.1.
github.com/navidrome/navidrome のその他の脆弱性
すべて見る →これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン