What is the CVSS score of CVE-2022-35909?

CVE-2022-35909 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.3%.

Is there a public PoC exploit available for CVE-2022-35909?

Yes, a public proof-of-concept exploit is available for CVE-2022-35909. Prioritise patching immediately. EPSS: 1.3%.

Is there a patch available for CVE-2022-35909?

Yes, a patch is available for CVE-2022-35909. Update the affected software to the latest version immediately.

Jellyfin CVE-2022-35909

HIGH

2022-08-19 cve@mitre.org

Information Disclosure Jellyfin

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Aug 19, 2022 - 13:15 nvd

HIGH 8.8

DescriptionNVD

In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality.

AnalysisAI

In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Technical ContextAI

In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality. Affected products include: Jellyfin. Version information: before 10.8.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Jellyfin

View all

CVE-2023-49096 HIGH This Week POC

8.8 Dec 06

Jellyfin is a Free Software Media System for managing and streaming media. Rated high severity (CVSS 8.8), this vulnerab

CVE-2023-30626 HIGH This Week POC

8.1 Apr 24

Jellyfin is a free-software media system. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, lo

CVE-2023-27161 HIGH This Week POC

7.5 Mar 10

Jellyfin up to v10.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /Repositories. R

CVE-2023-48702 HIGH This Week POC

7.2 Dec 13

Jellyfin is a system for managing and streaming media. Rated high severity (CVSS 7.2), this vulnerability is remotely ex

CVE-2021-21402 MEDIUM This Month POC

6.5 Mar 23

Jellyfin is a Free Software Media System. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable,

CVE-2026-35031 CRITICAL Act Now

9.9 Apr 14

Remote code execution as root in Jellyfin media server versions prior to 10.11.7 allows authenticated users with 'Upload

CVE-2021-29490 MEDIUM This Month POC

5.8 May 06

Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple ap

CVE-2023-30627 MEDIUM This Month POC

5.4 Apr 24

jellyfin-web is the web client for Jellyfin, a free-software media system. Rated medium severity (CVSS 5.4), this vulner

CVE-2023-23636 MEDIUM This Month POC

5.4 Feb 03

In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS. Rated medium severity (CVSS 5.4),

CVE-2023-23635 MEDIUM This Month POC

5.4 Feb 03

In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS. Rated medium severity (CVSS 5.4

CVE-2022-35910 MEDIUM This Month POC

5.4 Aug 19

In Jellyfin before 10.8, stored XSS allows theft of an admin access token. Rated medium severity (CVSS 5.4), this vulner

CVE-2026-35033 CRITICAL Act Now

9.3 Apr 14

Arbitrary file read via ffmpeg argument injection in Jellyfin media server versions before 10.11.7 allows unauthenticate

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2017-0213 HIGH POC

7.3

CVE-2022-35909 vulnerability details – vuln.today

Back

Jellyfin CVE-2022-35909

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

More in Jellyfin

Same technique Information Disclosure

Share

External POC / Exploit Code