PT-2021-9737

CVE-2020-15153

Published

2021-04-30

Updated

2021-05-09

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ampache versions prior to 4.2.2

Description The issue allows unauthenticated users to perform SQL injection. A fix for this issue is included in version 4.2.2 and the development branch.

Recommendations For versions prior to 4.2.2, update to version 4.2.2 or switch to the development branch to resolve the issue. As a temporary workaround, consider restricting access to sensitive database operations until the update can be applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Lachlan-00

Usox

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers