Airsonic Project

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

Airsonic Project records in CISA KEV

No Airsonic Project vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

3 records

TI-2019-08129 CVE-2019-10908 · GHSA-8p8f-c57x-4qw8

MEDIUM 45

In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random internally.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01611 Published 2019-04-07 No fix listed CWE-335

TI-2018-14331 CVE-2018-20222 · GHSA-8j9x-7hf9-69wq

MEDIUM 45

XXE issue in Airsonic before 10.1.2 during parse.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01714 Published 2019-04-04 No fix listed CWE-611

TI-2019-08128 CVE-2019-10907 · GHSA-wmxw-5jh4-p3j8

MEDIUM 44

Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in GlobalSecurityConfig.java.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.00924 Published 2019-04-07 No fix listed CWE-326