요약
- CVE-2024-56362은(는) github.com/navidrome/navidrome, navidrome (navidrome)에 영향을 주는 보통 (CVSS 5.5) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.15%, 전체 취약점의 4.5%보다 높음.
- 조치: 0.54.1 이상으로 업데이트하세요.
Description
Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret.
The JWT secret is critical for the authentication and authorization system. If exposed, an attacker could:
- Forge valid tokens to impersonate users, including administrative accounts.
- Gain unauthorized access to sensitive data or perform privileged actions.
This vulnerability has been tested on the latest version of Navidrome and poses a significant risk in environments where the database file is not adequately secured.
NVD description
Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. This vulnerability is fixed in 0.54.1.
github.com/navidrome/navidrome의 다른 취약점
모두 보기 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free