PatchTheCVEsubsonic vulnerabilities
Recent CVEs affecting subsonic products. 9 tracked.
subsonic has 9 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2018-12-19. Highest priority: CVE-2017-9414 (score 60/100).
- CVE-2018-9282 MEDIUM 6.1 DOWNGRADE An XSS issue was discovered in Subsonic Media Server 6.1.1
- CVE-2018-6014 MEDIUM 6.5 DOWNGRADE Subsonic v6.1.3 has an insecure allow-access-from domain="*" Flash cross-domain policy that allows an attacker
- CVE-2018-20228 HIGH 8.0 DOWNGRADE Subsonic V6.1.5 allows internetRadioSettings.view streamUrl CSRF, with resultant SSRF.
- CVE-2018-15898 MEDIUM 5.9 DOWNGRADE The Subsonic Music Streamer application 4.4 for Android has Improper Certificate Validation of the Subsonic se
- CVE-2018-14691 MEDIUM 6.1 DOWNGRADE An issue was discovered in Subsonic 6.1.1
- CVE-2018-14690 MEDIUM 6.1 DOWNGRADE An issue was discovered in Subsonic 6.1.1
- CVE-2018-14689 MEDIUM 6.1 DOWNGRADE An issue was discovered in Subsonic 6.1.1
- CVE-2018-14688 MEDIUM 6.1 DOWNGRADE An issue was discovered in Subsonic 6.1.1
- CVE-2017-9414 HIGH 8.8 DOWNGRADE Cross-site request forgery (CSRF) vulnerability in the Subscribe to Podcast feature in Subsonic 6.1.1 allows r
FAQ
How do I fix subsonic vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is subsonic being exploited right now?
None of the tracked subsonic CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which subsonic CVE should I patch first?
CVE-2017-9414 currently ranks highest (60/100): Cross-site request forgery (CSRF) vulnerability in the Subscribe to Podcast feature in Subsonic 6.1.1 allows r.