Vulnerability-Lookup

ubuntu-cve-2019-12385

Vulnerability from osv_ubuntu

Published

2019-08-22 19:15

Modified

2025-07-16 04:54

Summary

Details

An issue was discovered in Ampache through 3.9.1. The search engine is affected by a SQL Injection, so any user able to perform lib/class/search.class.php searches (even guest users) can dump any data contained in the database (sessions, hashed passwords, etc.). This may lead to a full compromise of admin accounts, when combined with the weak password generator algorithm used in the lostpassword functionality.

Severity

8.8 (High)


                    
                      CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2019-12385	REPORT
	https://www.tarlogic.com/en/blog/vulnerabilities-…	REPORT
	https://ubuntu.com/security/notices/USN-4693-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2019-12385	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "ampache",
            "binary_version": "3.6-rzb2779+dfsg-0ubuntu9.2"
          },
          {
            "binary_name": "ampache-common",
            "binary_version": "3.6-rzb2779+dfsg-0ubuntu9.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "ampache",
        "purl": "pkg:deb/ubuntu/ampache@3.6-rzb2779+dfsg-0ubuntu9.2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6-rzb2779+dfsg-0ubuntu9.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.6-rzb2779+dfsg-0ubuntu5",
        "3.6-rzb2779+dfsg-0ubuntu6",
        "3.6-rzb2779+dfsg-0ubuntu7",
        "3.6-rzb2779+dfsg-0ubuntu8",
        "3.6-rzb2779+dfsg-0ubuntu9",
        "3.6-rzb2779+dfsg-0ubuntu9.1"
      ]
    }
  ],
  "aliases": [],
  "details": "An issue was discovered in Ampache through 3.9.1. The search engine is affected by a SQL Injection, so any user able to perform lib/class/search.class.php searches (even guest users) can dump any data contained in the database (sessions, hashed passwords, etc.). This may lead to a full compromise of admin accounts, when combined with the weak password generator algorithm used in the lostpassword functionality.",
  "id": "UBUNTU-CVE-2019-12385",
  "modified": "2025-07-16T04:54:39Z",
  "published": "2019-08-22T19:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2019-12385"
    },
    {
      "type": "REPORT",
      "url": "https://www.tarlogic.com/en/blog/vulnerabilities-in-ampache/"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-4693-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-12385"
    }
  ],
  "related": [
    "USN-4693-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2019-12385"
  ]
}

CVE-2019-12385 (GCVE-0-2019-12385)

Vulnerability from cvelistv5 – Published: 2019-08-22 18:19 – Updated: 2024-08-04 23:17

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre

References

2 references

URL	Tags
https://www.tarlogic.com/en/blog/vulnerabilities-…	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST

Date Public

2019-08-21 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:17:39.932Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.tarlogic.com/en/blog/vulnerabilities-in-ampache/"
          },
          {
            "name": "[debian-lts-announce] 20191111 [SECURITY] [DLA 1988-1] ampache security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2019-08-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Ampache through 3.9.1. The search engine is affected by a SQL Injection, so any user able to perform lib/class/search.class.php searches (even guest users) can dump any data contained in the database (sessions, hashed passwords, etc.). This may lead to a full compromise of admin accounts, when combined with the weak password generator algorithm used in the lostpassword functionality."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-11-11T15:06:37.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.tarlogic.com/en/blog/vulnerabilities-in-ampache/"
        },
        {
          "name": "[debian-lts-announce] 20191111 [SECURITY] [DLA 1988-1] ampache security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00008.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-12385",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in Ampache through 3.9.1. The search engine is affected by a SQL Injection, so any user able to perform lib/class/search.class.php searches (even guest users) can dump any data contained in the database (sessions, hashed passwords, etc.). This may lead to a full compromise of admin accounts, when combined with the weak password generator algorithm used in the lostpassword functionality."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.tarlogic.com/en/blog/vulnerabilities-in-ampache/",
              "refsource": "MISC",
              "url": "https://www.tarlogic.com/en/blog/vulnerabilities-in-ampache/"
            },
            {
              "name": "[debian-lts-announce] 20191111 [SECURITY] [DLA 1988-1] ampache security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00008.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-12385",
    "datePublished": "2019-08-22T18:19:41.000Z",
    "dateReserved": "2019-05-28T00:00:00.000Z",
    "dateUpdated": "2024-08-04T23:17:39.932Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

usn-4693-1

Vulnerability from osv_ubuntu

Published

2021-01-14 21:13

Modified

2026-02-10 04:42

Summary

ampache vulnerabilities

Details

It was discovered that an SQL injection vulnerability exists in the Ampache search engine. Any user able to perform searches could dump any data contained in the database. An attacker could use this to disclose sensitive information. (CVE-2019-12385)

It was discovered that an XSS vulnerability in Ampache. An attacker could use this vulnerability to force an admin to create a new privileged user. (CVE-2019-12386)

References

URL

Type

	https://ubuntu.com/security/notices/USN-4693-1	ADVISORY
	https://ubuntu.com/security/CVE-2019-12385	REPORT
	https://ubuntu.com/security/CVE-2019-12386	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2019-12385",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2019-12386",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "ampache",
            "binary_version": "3.6-rzb2779+dfsg-0ubuntu9.2"
          },
          {
            "binary_name": "ampache-common",
            "binary_version": "3.6-rzb2779+dfsg-0ubuntu9.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "ampache",
        "purl": "pkg:deb/ubuntu/ampache@3.6-rzb2779+dfsg-0ubuntu9.2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6-rzb2779+dfsg-0ubuntu9.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.6-rzb2779+dfsg-0ubuntu5",
        "3.6-rzb2779+dfsg-0ubuntu6",
        "3.6-rzb2779+dfsg-0ubuntu7",
        "3.6-rzb2779+dfsg-0ubuntu8",
        "3.6-rzb2779+dfsg-0ubuntu9",
        "3.6-rzb2779+dfsg-0ubuntu9.1"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that an SQL injection vulnerability exists in the Ampache\nsearch engine. Any user able to perform searches could dump any data contained\nin the database. An attacker could use this to disclose sensitive information.\n(CVE-2019-12385)\n\nIt was discovered that an XSS vulnerability in Ampache. An attacker could use\nthis vulnerability to force an admin to create a new privileged user.\n(CVE-2019-12386)\n",
  "id": "USN-4693-1",
  "modified": "2026-02-10T04:42:02Z",
  "published": "2021-01-14T21:13:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-4693-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2019-12385"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2019-12386"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "ampache vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2019-12385",
    "UBUNTU-CVE-2019-12386"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2019-12385

Vulnerability from osv_ubuntu

CVE-2019-12385 (GCVE-0-2019-12385)

usn-4693-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature