Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but not backslashes. A backslash-quote sequence can terminate the string, so an unauthenticated attacker can send a crafted link that executes script in the Tautulli web context when an authenticated user follows it.
This issue is fixed in version 2.17.2.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Active
User action required
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
tautulli:tautulli
References 3
https://github.com/Tautulli/Tautulli/security/advisories/GHSA-mjvc-6cc2-6ffr
https://github.com/Tautulli/Tautulli/security/advisories/GHSA-mjvc-6cc2-6ffr
https://github.com/Tautulli/Tautulli/commit/3bee54087370fc275b13565a9e58235341b…
https://github.com/Tautulli/Tautulli/commit/3bee54087370fc275b13565a9e58235341bb4cf7
https://github.com/Tautulli/Tautulli/releases/tag/v2.17.2
https://github.com/Tautulli/Tautulli/releases/tag/v2.17.2