关联漏洞
标题：Emby Server 环境问题漏洞 (CVE-2023-33193)描述：Emby Server是个人开发者的一款功能强大的媒体服务器。该产品主要可用于视频音频和照片等多媒体整合编辑。 Emby Server 4.7.12之前版本存在安全漏洞，该漏洞源于通过欺骗某些旨在与反向代理服务器互操作的标头，可能会影响本地/非本地网络的确定，以允许在没有密码的情况下登录或查看可能没有配置密码的用户帐户列表。
描述
Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewing at home and abroad on a broad range of client devices. This vulnerability may allow administrative access to an Emby Server system, depending on certain user account settings. By spoofing certain headers which are intended for interoperation with reverse proxy servers, it may be possible to affect the local/non-local network determination to allow logging in without password or to view a list of user accounts which may have no password configured. Impacted are all Emby Server system which are publicly accessible and where the administrator hasn't tightened the account login configuration for administrative users. This issue has been patched in Emby Server Beta version 4.8.31 and Emby Server version 4.7.12.
文件快照
id: CVE-2023-33193
info:
name: Emby Server - Authentication Bypass
author: daffainfo
severity
...
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。