CVE-2023-30627: jellyfin

csirt@kutim:~/threat-intel/cve/CVE-2023-30627

CVSS 5.4 · Medium EPSS 1,3%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada jellyfin. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

jellyfin-web is the web client for Jellyfin, a free-software media system. Starting in version 10.1.0 and prior to version 10.8.10, a stored cross-site scripting vulnerability in device.js can be used to make arbitrary calls to the `REST` endpoints with admin privileges. When combined with CVE-2023-30626, this results in remote code execution on the Jellyfin instance in the context of the user who's running it. This issue is patched in version 10.8.10. There are no known workarounds.

Rincian

Terbit di NVD: 24 April 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 1,3% peluang dieksploitasi; lebih tinggi dari 69,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
jellyfin	jellyfin	Versi 10.1.0 hingga sebelum 10.8.10

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/jellyfin/jellyfin-web/security/advisories/GHSA-89hp-h43h-r5pq advisory vendor
https://github.com/jellyfin/jellyfin/security/advisories/GHSA-9p5f-5x8v-x65m exploit · patch · advisory vendor
https://github.com/jellyfin/jellyfin-web/commit/b88a5951e1a517ff4c820e693d9c0da981cf68ee patch
https://github.com/jellyfin/jellyfin-web/releases/tag/v10.8.10 release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.