CVE-2024-51485 - CVE House
Back to Database
Status published Medium CVE-2024-51485

Insufficient Validation in Plugins (Activation/Deactivation) in Ampache

Vulnerability Description

Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens when activating or deactivating plugins. This vulnerability allows an attacker to exploit CSRF attacks, potentially enabling them to change website features that should only be managed by administrators through malicious requests. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-51485

Credits & Attribution

No credits recorded in the NVD database.

References

More from ampache

View All →
CVE-2024-51490
Stored Cross-Site Scripting in Ampache
Medium 5.5
CVE-2024-51489
Insufficient Message Token Validation in Ampache
Medium 5.3
CVE-2024-51488
Insufficient Validation in Delete Message in Ampache
Medium 5.3
CVE-2024-51487
Insufficient Validation in Catalog (Activation/Deactivation) in Ampache
Medium 5.3
CVE-2024-51486
Stored Cross-Site Scripting in Ampache
Medium 5.5

Affected Vendor

Affected Software

ampache
Vulnerable Versions:
< 7.0.1

Timeline

Official Publish: November 11th, 2024
Last Modified: November 12th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-352

MITRE ATT&CK TTPs

T1566.002 Spearphishing Link
Initial Access
T1204.001 Malicious Link
Execution
T1098 Account Manipulation
Persistence
T1565.001 Stored Data Manipulation
Impact