{"id":"CVE-2024-51144","aliases":["EUVD-2025-6160","GHSA-j3gx-p9r2-3cwr","UBUNTU-CVE-2024-51144"],"status":"published","title":"Cross Site Request Forgery (CSRF) vulnerability exists in the 'pvmsg.php?action=add_message',...","description":"Cross Site Request Forgery (CSRF) vulnerability exists in the 'pvmsg.php?action=add_message', pvmsg.php?action=confirm_delete , and ajax.server.php?page=user\u0026action=flip_follow endpoints in Ampache \u003c= 6.6.0.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-08","score":0.00473,"percentile":0.41117,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2025-03-05T00:00:00Z","modified":"2026-06-17T08:05:27Z","affected":[{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ampache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6-rzb2779+dfsg-0ubuntu5","3.6-rzb2779+dfsg-0ubuntu6","3.6-rzb2779+dfsg-0ubuntu7","3.6-rzb2779+dfsg-0ubuntu8","3.6-rzb2779+dfsg-0ubuntu9","3.6-rzb2779+dfsg-0ubuntu9.1","3.6-rzb2779+dfsg-0ubuntu9.2"]}],"references":[{"url":"https://github.com/ampache/ampache","tags":["report"]},{"url":"https://nitipoom-jar.github.io/CVE-2024-51144/","tags":["report"]},{"url":"https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2024-51144"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-51144"},{"url":"https://nitipoom-jar.github.io/CVE-2024-51144"},{"url":"https://github.com/advisories/GHSA-j3gx-p9r2-3cwr"},{"url":"https://ubuntu.com/security/CVE-2024-51144","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-51144","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-51144","description":"Cross Site Request Forgery (CSRF) vulnerability exists in the 'pvmsg.php?action=add_message', pvmsg.php?action=confirm_delete , and ajax.server.php?page=user\u0026action=flip_follow endpoints in Ampache \u003c= 6.6.0.","status":"published","published":"2025-03-05T00:00:00Z","modified":"2025-09-30T13:42:08.029Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:34:01.630882Z"}],"euvd":[{"id":"EUVD-2025-6160","description":"Cross Site Request Forgery (CSRF) vulnerability exists in the 'pvmsg.php?action=add_message', pvmsg.php?action=confirm_delete , and ajax.server.php?page=user\u0026action=flip_follow endpoints in Ampache \u003c= 6.6.0.","status":"published","published":"2025-03-05T00:00:00Z","modified":"2025-09-30T13:42:08Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:31:38.096877Z"}],"ghsa":[{"id":"GHSA-j3gx-p9r2-3cwr","title":"Cross Site Request Forgery (CSRF) vulnerability exists in the 'pvmsg.php?action=add_message',...","description":"Cross Site Request Forgery (CSRF) vulnerability exists in the 'pvmsg.php?action=add_message', pvmsg.php?action=confirm_delete , and ajax.server.php?page=user\u0026action=flip_follow endpoints in Ampache \u003c= 6.6.0.","status":"published","published":"2025-03-05T21:32:12Z","modified":"2025-09-29T15:30:31Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:03:48.046839Z"}],"nvd":[{"id":"CVE-2024-51144","description":"Cross Site Request Forgery (CSRF) vulnerability exists in the 'pvmsg.php?action=add_message', pvmsg.php?action=confirm_delete , and ajax.server.php?page=user\u0026action=flip_follow endpoints in Ampache \u003c= 6.6.0.","status":"published","published":"2025-03-05T20:16:05.603Z","modified":"2026-06-17T08:05:27.007Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:10:45.422466Z"}],"osv":[{"id":"UBUNTU-CVE-2024-51144","description":"Cross Site Request Forgery (CSRF) vulnerability exists in the 'pvmsg.php?action=add_message', pvmsg.php?action=confirm_delete , and ajax.server.php?page=user\u0026action=flip_follow endpoints in Ampache \u003c= 6.6.0.","status":"published","published":"2025-03-05T20:16:00Z","modified":"2025-10-24T05:14:29Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:11.182485Z"}]}}