PatchTheCVEairsonic project vulnerabilities
Recent CVEs affecting airsonic project products. 3 tracked.
airsonic project has 3 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 1. Most recent: 2019-04-07. Highest priority: CVE-2019-10908 (score 63/100).
- CVE-2019-10908 CRITICAL 9.8 DOWNGRADE In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils,
- CVE-2019-10907 CRITICAL 9.8 DOWNGRADE Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in Glob
- CVE-2018-20222 CRITICAL 9.8 UPGRADE XXE issue in Airsonic before 10.1.2 during parse.
FAQ
How do I fix airsonic project vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is airsonic project being exploited right now?
None of the tracked airsonic project CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which airsonic project CVE should I patch first?
CVE-2019-10908 currently ranks highest (63/100): In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, .