CVE-2024-51144

Name of the Vulnerable Software and Affected Versions Ampache versions 6.6.0 and earlier

Description A Cross Site Request Forgery (CSRF) issue exists in the "pvmsg.php?action=add message", "pvmsg.php?action=confirm delete", and "ajax.server.php?page=user&action=flip follow" endpoints.

Recommendations For Ampache versions 6.6.0 and earlier, update to a version later than 6.6.0 to resolve the issue. As a temporary workaround, consider restricting access to the "pvmsg.php?action=add message", "pvmsg.php?action=confirm delete", and "ajax.server.php?page=user&action=flip follow" endpoints until a patch is available.