CVE-2024-56362
Navidrome Stores JWT Secret in Plaintext in navidrome.db
Résumé
Navidrome Stores JWT Secret in Plaintext in navidrome.db
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. This vulnerability is fixed in 0.54.1.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com