Web Application FirewallJellyfin.Aribitrary.File.Read
Description
Jellyfin is a Free Software Media System. In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from a Jellyfin server's file system. This issue is more prevalent when Windows is used as the host OS. Servers that are exposed to the public Internet are potentially at risk.
Affected Products
Jellyfin before version 10.7.1
Impact
Information Disclosure: Remote attackers can gain sensitive information from vulnerable systems.
Recommended Actions
Apply the most recent upgrade or patch from the vendor.
https://jellyfin.org
Version Updates
| Date | Version | Status | Detail |
|---|---|---|---|
| 2024-11-06 | 1.00057 |
New
|
| ID | 1002017415 |
| Created | Nov 07, 2024 |
| Updated | Nov 07, 2024 |
| CVE ID | |
| Risk |
|
| Default Action | drop |
| Active | |
| Affected OS | All |
| Affected App | Jellyfin |