Vulnerabilities

TI-2019-08129 CVE-2019-10908 · GHSA-8p8f-c57x-4qw8

In Airsonic 10.2.1, RecoverController.java generates passwords via…

MEDIUM 45

In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random internally.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01611 Published 2019-04-07 No fix listed CWE-335

TI-2019-08128 CVE-2019-10907 · GHSA-wmxw-5jh4-p3j8

MEDIUM 44

Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in GlobalSecurityConfig.java.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.00924 Published 2019-04-07 No fix listed CWE-326

TI-2018-14331 CVE-2018-20222 · GHSA-8j9x-7hf9-69wq

MEDIUM 45

XXE issue in Airsonic before 10.1.2 during parse.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01714 Published 2019-04-04 No fix listed CWE-611