In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage of the victim.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-02-03T00:00:00

Updated: 2024-08-02T10:35:33.632Z

Reserved: 2023-01-16T00:00:00

Link: CVE-2023-23635

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2023-02-03T01:15:14.620

Modified: 2024-11-21T07:46:34.890

Link: CVE-2023-23635

cve-icon Redhat

No data.