{"id":"CVE-2019-19833","aliases":["EUVD-2019-0166","GHSA-cqvv-6jhx-qvwf","PYSEC-2019-254"],"status":"published","title":"In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media...","description":"In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. (Also, anonymous access can be achieved in applications that do not have a user login area).","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.14706,"percentile":0.96694,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2019-12-18T17:08:42Z","modified":"2026-10-20T10:52:32Z","exploits":[{"source":"metasploit","id":"auxiliary/dos/http/tautulli_shutdown_exec","title":"Tautulli v2.1.9 - Shutdown Denial of Service","type":"auxiliary","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/dos/http/tautulli_shutdown_exec"}],"products":[{"vendor":"tautulli","product":"tautulli"}],"references":[{"url":"https://github.com/Tautulli/Tautulli/compare/v2.1.9...v2.1.10-beta","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"http://packetstormsecurity.com/files/155710/Tautulli-2.1.9-Cross-Site-Request-Forgery.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","advisory"]},{"url":"http://packetstormsecurity.com/files/155974/Tautulli-2.1.9-Denial-Of-Service.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19833"},{"url":"https://github.com/advisories/GHSA-cqvv-6jhx-qvwf"}],"sources":{"cve":[{"id":"CVE-2019-19833","description":"In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. (Also, anonymous access can be achieved in applications that do not have a user login area).","status":"published","published":"2019-12-18T17:08:42Z","modified":"2024-08-05T02:25:12.749Z","updated_at":"2026-11-02T14:20:21.059499Z"}],"euvd":[{"id":"EUVD-2019-0166","description":"In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. (Also, anonymous access can be achieved in applications that do not have a user login area).","status":"published","published":"2019-12-18T17:08:42Z","modified":"2024-08-05T02:25:12Z","updated_at":"2026-11-03T02:40:24.842572Z"}],"ghsa":[{"id":"GHSA-cqvv-6jhx-qvwf","title":"In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media...","description":"In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. (Also, anonymous access can be achieved in applications that do not have a user login area).","status":"published","published":"2022-05-24T17:04:02Z","modified":"2023-02-01T21:30:24Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:50:56.67974Z"}],"nvd":[{"id":"CVE-2019-19833","description":"In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. (Also, anonymous access can be achieved in applications that do not have a user login area).","status":"published","published":"2019-12-18T18:15:20.147Z","modified":"2026-06-17T02:27:18.973Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:05:40.258829Z"}],"osv":[{"id":"CVE-2019-19833","description":"In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. (Also, anonymous access can be achieved in applications that do not have a user login area).","status":"published","published":"2019-12-18T18:15:20.147Z","modified":"2026-10-20T10:52:32.894664859Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:12.010761Z"},{"id":"PYSEC-2019-254","description":"In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. (Also, anonymous access can be achieved in applications that do not have a user login area).","status":"withdrawn","published":"2019-12-18T18:15:00Z","modified":"2025-10-09T06:52:53.458752Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:52.192131Z"}]}}