Jellyfin におけるパストラバーサルの脆弱性
| Title |
Jellyfin におけるパストラバーサルの脆弱性
|
| Summary |
Jellyfin には、パストラバーサルの脆弱性が存在します。
|
| Possible impacts |
情報を取得される可能性があります。 |
| Solution |
ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date |
March 22, 2021, midnight |
| Registration Date |
Dec. 1, 2021, 2:33 p.m. |
| Last Update |
Dec. 1, 2021, 2:33 p.m. |
|
CVSS3.0 : 警告
|
| Score |
6.5
|
| Vector |
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
|
CVSS2.0 : 警告
|
| Score |
4
|
| Vector |
AV:N/AC:L/Au:S/C:P/I:N/A:N |
Affected System
| jellyfin |
|
jellyfin 10.7.1 未満
|
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
Change Log
| No |
Changed Details |
Date of change |
| 1 |
[2021年12月01日]
掲載 |
Dec. 1, 2021, 2:33 p.m. |
NVD Vulnerability Information
CVE-2021-21402
| Summary |
Jellyfin is a Free Software Media System. In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from a Jellyfin server's file system. This issue is more prevalent when Windows is used as the host OS. Servers that are exposed to the public Internet are potentially at risk. This is fixed in version 10.7.1. As a workaround, users may be able to restrict some access by enforcing strict security permissions on their filesystem, however, it is recommended to update as soon as possible.
|
| Publication Date |
March 24, 2021, 5:15 a.m. |
| Registration Date |
March 24, 2021, 10:02 a.m. |
| Last Update |
Nov. 21, 2024, 2:48 p.m. |
Affected software configurations
| Configuration1 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:jellyfin:jellyfin:*:*:*:*:*:*:*:* |
|
|
|
10.7.1 |
Related information, measures and tools
Common Vulnerabilities List