CVE-2023-48702
CVSS 3.1 Score 7.2 of 10 (high)
Details
Summary
CVE-2023-48702 is a vulnerability found in Jellyfin, a media management and streaming system. It affects versions prior to 10.8.13. The vulnerability allows a malicious administrator to set up a network share and provide a UNC path to the `/System/MediaEncoder/Path` endpoint, which can execute an arbitrary file in the local context of the Jellyfin server using `ProcessStartInfo` and the `ValidateVersion` function. The danger posed by this vulnerability is high, as it could allow an attacker to run malicious executables on the server. To remediate this vulnerability, users should update their Jellyfin installations to version 10.8.13 or newer, as the vulnerable endpoint has been removed in this version.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions