CVE-2013-7301 Cantata before 1.2.2 does not restrict access to files in the play queue, which allows remote attackers to obtain sensitive information by reading the songs in the queue.
MediumCVSS 5.0
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cantata before 1.2.2 does not restrict access to files in the play queue, which allows remote attackers to obtain sensitive information by reading the songs in the queue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| craig drummond cantata | <= 1.2.1 | No fix listed |
| craig drummond cantata | = 0.7.0 | No fix listed |
| craig drummond cantata | = 0.7.1 | No fix listed |
| craig drummond cantata | = 0.8.0 | No fix listed |
| craig drummond cantata | = 0.8.1 | No fix listed |
| craig drummond cantata | = 0.8.2 | No fix listed |
| craig drummond cantata | = 0.8.3 | No fix listed |
| craig drummond cantata | = 0.8.3.1 | No fix listed |
| craig drummond cantata | = 0.9.0 | No fix listed |
| craig drummond cantata | = 0.9.1 | No fix listed |
| craig drummond cantata | = 0.9.2 | No fix listed |
| craig drummond cantata | = 1.0.0 | No fix listed |
| craig drummond cantata | = 1.0.1 | No fix listed |
| craig drummond cantata | = 1.0.2 | No fix listed |
| craig drummond cantata | = 1.0.3 | No fix listed |
| craig drummond cantata | = 1.1.0 | No fix listed |
| craig drummond cantata | = 1.1.1 | No fix listed |
| craig drummond cantata | = 1.1.2 | No fix listed |
| craig drummond cantata | = 1.1.3 | No fix listed |
| craig drummond cantata | = 1.2.0 | No fix listed |
References
- [oss-security] 20140120 CVE request: Cantata vulnerability mailing-list
- [oss-security] 20140120 Re: CVE request: Cantata vulnerability mailing-list
- code.google.com exploit
- Debian Security Tracker CVE-2013-7301 vendor-advisory