Description
Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics() and show_lyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute code in the browser of any user viewing the lyrics.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ampache | ampache | < 8.4.0 | 8.4.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | ampache | No fix yet | — |
References
- Patch Commit patch
- https://github.com/ampache/ampache product
- https://github.com/ampache/ampache/blob/8.3.0/src/Gui/Song/LyricsView.php#L70 technical-description
- ampache 8.4.0 Release Notes release-notes
- VulnCheck Advisory: Ampache before 8.4.0 Stored XSS via Song Lyrics ID3 Tag third-party-advisory