Read the docs
TI-2024-34405 Aliases CVE-2024-51484

Insufficient Validation in Controllers (Activation/Deactivation) in Ampache

Priority LOW 24CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Tampering
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens when activating or deactivating controllers. This vulnerability allows an attacker to exploit CSRF attacks, potentially enabling them to change website features that should only be managed by administrators through malicious requests. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00357 29th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed ampache (ampache): 7.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ampacheampachebefore 7.0.17.0.1Patch availableCNA
  • ampache Vendorampache Affected before 7.0.1 Fixed in 7.0.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ampache:ampache:7.0.0:*:*:*:*:*:*:*7.0.0Vulnerableampache
  • cpe:2.3:a:ampache:ampache:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·ampache

Remediation

  • Fix · CNA ampache (ampache) Fixed in 7.0.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-51484

References

Exploit 1

  • TI-2023-00731 SQL Injection in ampache/ampache CVSS 3.1HIGH 8.8
  • TI-2022-04263 Unrestricted Upload of File with Dangerous Type in ampache/ampache CVSS 3.1HIGH 8.8
  • TI-2024-32095 Cross-Site Request Forgery in ampache CVSS 3.1MEDIUM 6.5
  • TI-2023-00573 Cross-site Scripting (XSS) - Reflected in ampache/ampache CVSS 3.1MEDIUM 6.1
  • TI-2024-31551 Ampache vulnerable to Stored XSS via Democratic Playlist Name CVSS 3.1MEDIUM 6.1
  • TI-2024-19055 Ampache Stored XSS CVSS 3.1MEDIUM 5.9
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences