GitHub Advisoryadvisory · Go

GHSA-hrmx-8jjv-g758 Navidrome uses MD5 hashing algorithm

MEDIUM Published 2024-08-01 Modified 2024-08-07 Official page ↗
Aliases
CVE-2024-41259
Ecosystem
Go
Packages
github.com/navidrome/navidrome
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-200, CWE-305, CWE-306
Reviewed
2024-08-02

Affected packages

• Go github.com/navidrome/navidrome: <= 0.52.3 (no fix yet)

Description

Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account information.

Related

Alias · CVE (1)

  • CVE-2024-41259 Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account… vulnerability

Weakness · CWE (3)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-305 Authentication Bypass by Primary Weakness weakness
  • CWE-306 Missing Authentication for Critical Functionality weakness

References