DNS Rebinding Affecting minidlna package, versions [,1.3.1)
Snyk CVSS
Attack Complexity
Low
User Interaction
Required
Confidentiality
High
Threat Intelligence
EPSS
0.33% (71st
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-UNMANAGED-MINIDLNA-2419090
- published 7 Mar 2022
- disclosed 7 Mar 2022
- credit Unknown
Introduced: 7 Mar 2022
CVE-2022-26505 Open this link in a new tabHow to fix?
Upgrade minidlna to version 1.3.1 or higher.
Overview
Affected versions of this package are vulnerable to DNS Rebinding in upnphttp.c and upnphttp.h. By tricking the victim's browser into triggering arbitrary UPnP requests on the local DLNA server, the attacker can list the available media files and download them;