Is CVE-2021-29490 actively exploited?

CVE-2021-29490 has no public evidence of in-the-wild exploitation as of 2024-11-21.

What is the CVSS score for CVE-2021-29490?

CVE-2021-29490 has a CVSS score of 5.8 (MEDIUM severity). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N.

How do I patch CVE-2021-29490?

Patch guidance is available from jellyfin security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2021-29490.

CVE-2021-29490 - remediation guidance & executive summary

Description

Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. Verions prior to 10.7.3 vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the imageUrl parameter. This issue potentially exposes both internal and external HTTP servers or other resources available via HTTP `GET` that are visible from the Jellyfin server. The vulnerability is patched in version 10.7.3. As a workaround, disable external access to the API endpoints `/Items/*/RemoteImages/Download`, `/Items/RemoteSearch/Image` and `/Images/Remote` via reverse proxy, or limit to known-friendly IPs.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Attack Vector: network
Complexity: low
Privileges: none
User Action: none
Scope: changed
Confidentiality: low
Integrity: none
Availability: none
Weaknesses: CWE-918 · Server-Side Request Forgery

Metadata

Primary Vendor: JELLYFIN
Published: 5/6/2021
Last Modified: 11/21/2024
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

CVE-2021-29490

Description

CVSS Metrics

Metadata

Affected Products

Remediation Guidance

Executive Summary