Back to search
CVE-2019-12385
Published: Aug 22, 2019
Modified: Aug 4, 2024
PUBLISHED
Description
An issue was discovered in Ampache through 3.9.1. The search engine is affected by a SQL Injection, so any user able to perform lib/class/search.class.php searches (even guest users) can dump any data contained in the database (sessions, hashed passwords, etc.). This may lead to a full compromise of admin accounts, when combined with the weak password generator algorithm used in the lostpassword functionality.
| Vendor | Product | Versions |
|---|---|---|
n/a | n/a | affected n/a |
References
https://www.tarlogic.com/en/blog/vulnerabilities-in-ampache/
x_refsource_MISC
[debian-lts-announce] 20191111 [SECURITY] [DLA 1988-1] ampache security update
mailing-list
x_refsource_MLIST
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now