PatchTheCVEsubsonic vulnerabilities and fixes
Recent CVEs affecting subsonic, with upgrade or downgrade steps. 11 tracked.
subsonic has 11 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2018-12-19. Highest priority: CVE-2017-9414 (score 60/100).
- CVE-2018-9282 MEDIUM 6.1 DOWNGRADE An XSS issue was discovered in Subsonic Media Server 6.1.1
- CVE-2018-6014 MEDIUM 6.5 DOWNGRADE Subsonic v6.1.3 has an insecure allow-access-from domain="*" Flash cross-domain policy that allows an attacker
- CVE-2018-20228 HIGH 8.0 DOWNGRADE Subsonic V6.1.5 allows internetRadioSettings.view streamUrl CSRF, with resultant SSRF.
- CVE-2018-14691 MEDIUM 6.1 DOWNGRADE An issue was discovered in Subsonic 6.1.1
- CVE-2018-14690 MEDIUM 6.1 DOWNGRADE An issue was discovered in Subsonic 6.1.1
- CVE-2018-14689 MEDIUM 6.1 DOWNGRADE An issue was discovered in Subsonic 6.1.1
- CVE-2018-14688 MEDIUM 6.1 DOWNGRADE An issue was discovered in Subsonic 6.1.1
- CVE-2017-9415 HIGH 7.5 DOWNGRADE Cross-site request forgery (CSRF) vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of th
- CVE-2017-9414 HIGH 8.8 DOWNGRADE Cross-site request forgery (CSRF) vulnerability in the Subscribe to Podcast feature in Subsonic 6.1.1 allows r
- CVE-2017-9413 HIGH 8.8 DOWNGRADE Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remo
- CVE-2017-9355 HIGH 7.4 DOWNGRADE XML external entity (XXE) vulnerability in the import playlist feature in Subsonic 6.1.1 might allow remote at
FAQ
How do I fix subsonic vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is subsonic being exploited right now?
None of the tracked subsonic CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which subsonic CVE should I patch first?
CVE-2017-9414 currently ranks highest (60/100): Cross-site request forgery (CSRF) vulnerability in the Subscribe to Podcast feature in Subsonic 6.1.1 allows r.