CVE-2019-12385 - CVE House
Back to Database
Status published High CVE-2019-12385

An issue was discovered in Ampache through 3.9.1. The search...

Vulnerability Description

An issue was discovered in Ampache through 3.9.1. The search engine is affected by a SQL Injection, so any user able to perform lib/class/search.class.php searches (even guest users) can dump any data contained in the database (sessions, hashed passwords, etc.). This may lead to a full compromise of admin accounts, when combined with the weak password generator algorithm used in the lostpassword functionality.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-12385

Credits & Attribution

No credits recorded in the NVD database.

References

More from ampache

View All →
CVE-2024-51490
Stored Cross-Site Scripting in Ampache
Medium 5.5
CVE-2024-51489
Insufficient Message Token Validation in Ampache
Medium 5.3
CVE-2024-51488
Insufficient Validation in Delete Message in Ampache
Medium 5.3
CVE-2024-51487
Insufficient Validation in Catalog (Activation/Deactivation) in Ampache
Medium 5.3
CVE-2024-51486
Stored Cross-Site Scripting in Ampache
Medium 5.5

Affected Vendor

Affected Software

ampache
Vulnerable Versions:
0

Timeline

Official Publish: August 22nd, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.