Unrated severityNVD Advisory· Published Apr 24, 2023· Updated Feb 12, 2025
jellyfin-web has a stored cross-site scripting vulnerability in devices.js
CVE-2023-30627
Description
jellyfin-web is the web client for Jellyfin, a free-software media system. Starting in version 10.1.0 and prior to version 10.8.10, a stored cross-site scripting vulnerability in device.js can be used to make arbitrary calls to the REST endpoints with admin privileges. When combined with CVE-2023-30626, this results in remote code execution on the Jellyfin instance in the context of the user who's running it. This issue is patched in version 10.8.10. There are no known workarounds.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/jellyfin/jellyfin-web/commit/b88a5951e1a517ff4c820e693d9c0da981cf68eemitrex_refsource_MISC
- github.com/jellyfin/jellyfin-web/releases/tag/v10.8.10mitrex_refsource_MISC
- github.com/jellyfin/jellyfin-web/security/advisories/GHSA-89hp-h43h-r5pqmitrex_refsource_CONFIRM
- github.com/jellyfin/jellyfin/security/advisories/GHSA-9p5f-5x8v-x65mmitrex_refsource_MISC
News mentions
0No linked articles in our index yet.