CVE-2022-36223

Published Dec 16, 2022

Last updated a year ago

CVSS medium 6.1

Overview

Description: In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administrator access token and flip or steal the media server administrator account.
Source: cve@mitre.org
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.1
Impact score: 2.7
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-79

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:emby:emby:4.6.7.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A5594D8F-4EB6-4ECD-9280-EFD9BA711720"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References