CVE Feed

    Dashboard / CVE / CVE-2021-32833

    CVE-2021-32833

    Emby Server is a personal media server with apps on many devices. In Emby Server on Windows there is a set of arbitrary file read vulnerabilities. This vulnerability is known to exist in version 4.6.4.0 and may not be patched in later versions. Known vulnerable routes are /Videos/Id/hls/PlaylistId/SegmentId.SegmentContainer, /Images/Ratings/theme/name and /Images/MediaInfo/theme/name. For more details including proof of concept code, refer to the referenced GHSL-2021-051. This issue may lead to unauthorized access to the system especially when Emby Server is configured to be accessible from the Internet.

    Published:Sep 9, 2021
    Last Modified:Nov 21, 2024
    EPS:Sep 9, 2021
    EPSS Score:0.00377
    CVSS Score:8.6

    Affected Products

    Vendor
    Emby
    Product
    Emby.releases

    Exploits

    https://securitylab.github.com/advisories/GHSL-2021-051-emby/https://securitylab.github.com/advisories/GHSL-2021-051-emby/

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-150 Collect Data from Common Resource Locations
    CAPEC-639 Probe System Files

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High