writeups.xyz / CVE-2022–35909 / CVE-2022–35910, Incorrect Access Control and XSS Stored to Jellyfin

Submitter : c2a

Date: 18 July 2022

Bounty : undisclosed

Vulnerabilities :

• Broken Access Control
• XSS

Programs :

• Jellyfin

Authors :

• Dan Barros
• Eduardo Cardoso

Link :
https://medium.com/stolabs/cve-2022-35909-cve-2022-35910-incorrect-access-control-and-xss-stored-to-jellyfin-967359c91058