Jellyfin is a free-software media system. Versions starting with 10.8.0 and prior to 10.8.10 and prior have a directory traversal vulnerability inside the `ClientLogController`, specifically `/ClientLog/Document`. When combined with a cross-site scripting vulnerability (CVE-2023-30627), this can result in file write and arbitrary code execution. Version 10.8.10 has a patch for this issue. There are no known workarounds.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jellyfin is a free-software media system. Versions starting with 10.8.0 and prior to 10.8.10 and prior
    have a directory traversal vulnerability inside the `ClientLogController`, specifically
    `/ClientLog/Document`. When combined with a cross-site scripting vulnerability (CVE-2023-30627), this can
    result in file write and arbitrary code execution. Version 10.8.10 has a patch for this issue. There are
    no known workarounds. (CVE-2023-30626)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 4ee322e9-e363-11ed-b934-b42e991fc52e advisory.

  - Jellyfin is a free-software media system. Versions starting with 10.8.0 and prior to 10.8.10 and prior     have a directory traversal vulnerability inside the `ClientLogController`, specifically     `/ClientLog/Document`. When combined with a cross-site scripting vulnerability (CVE-2023-30627), this can     result in file write and arbitrary code execution. Version 10.8.10 has a patch for this issue. There are     no known workarounds. (CVE-2023-30626)

  - jellyfin-web is the web client for Jellyfin, a free-software media system. Starting in version 10.1.0 and     prior to version 10.8.10, a stored cross-site scripting vulnerability in device.js can be used to make     arbitrary calls to the `REST` endpoints with admin privileges. When combined with CVE-2023-30626, this     results in remote code execution on the Jellyfin instance in the context of the user who's running it.
    This issue is patched in version 10.8.10. There are no known workarounds. (CVE-2023-30627)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
413383	SCA: security update for Jellyfin.Controller (GHSA-9p5f-5x8v-x65m)	Tenable Cloud Security	SCA Checks	high
413383	SCA: security update for Jellyfin.Controller (GHSA-9p5f-5x8v-x65m)	Tenable Self-Hosted Container Security	SCA Checks	high
174724	FreeBSD : jellyfin -- Multiple vulnerabilities (4ee322e9-e363-11ed-b934-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2023-30626

high

Tenable Plugins

high

high

high