CVE-2021-32833

Emby Server is a personal media server with apps on many devices. In Emby Server on Windows there is a set of arbitrary file read vulnerabilities. This vulnerability is known to exist in version 4.6.4.0 and may not be patched in later versions. Known vulnerable routes are /Videos/Id/hls/PlaylistId/SegmentId.SegmentContainer, /Images/Ratings/theme/name and /Images/MediaInfo/theme/name. For more details including proof of concept code, refer to the referenced GHSL-2021-051. This issue may lead to unauthorized access to the system especially when Emby Server is configured to be accessible from the Internet.

Emby Server is a personal media server with apps on many devices. In Emby Server on Windows there is a set of arbitrary file read vulnerabilities. This vulnerability is known to exist in version 4.6.4.0 and may not be patched in later versions. Known vulnerable routes are /Videos/Id/hls/PlaylistId/SegmentId.SegmentContainer, /Images/Ratings/theme/name and /Images/MediaInfo/theme/name. For more details including proof of concept code, refer to the referenced GHSL-2021-051. This issue may lead to unauthorized access to the system especially when Emby Server is configured to be accessible from the Internet.

Emby Server es un servidor multimedia personal con aplicaciones en muchos dispositivos. En Emby Server en Windows se presenta un conjunto de vulnerabilidades de lectura arbitraria de archivos. Se sabe que esta vulnerabilidad se presenta en la versión 4.6.4.0 y puede no estar parcheada en versiones posteriores. Las rutas vulnerables conocidas son /Videos/Id/hls/PlaylistId/SegmentId.SegmentContainer, /Images/Ratings/theme/name y /Images/MediaInfo/theme/name. Para conseguir más detalles, incluyendo el código de prueba de concepto, consulte la referencia GHSL-2021-051. Este problema puede conllevar a un acceso no autorizado al sistema, especialmente cuando Emby Server está configurado para ser accesible desde Internet