Description (CNA)
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but not backslashes. A backslash-quote sequence can terminate the string, so an unauthenticated attacker can send a crafted link that executes script in the Tautulli web context when an authenticated user follows it. This issue is fixed in version 2.17.2.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Tautulli / Tautulli | affected < 2.17.2 |
CWE
CWE-79
References
- https://github.com/Tautulli/Tautulli/security/advisories/GHSA-mjvc-6cc2-6ffr
- https://github.com/Tautulli/Tautulli/commit/3bee54087370fc275b13565a9e58235341bb4cf7
- https://github.com/Tautulli/Tautulli/releases/tag/v2.17.2
ADP enrichment
No English description supplied.