Go to homepageCyberStrike

Menu

Star on GitHub · 3.2k
Sign inDownload

CVE-2023-33193

9.1 · CRITICAL

Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewing at home and abroad on a broad range…

Published May 30, 2023CWE-444EPSS 1.70%

Overview

CVE-2023-33193 is a critical-severity vulnerability. It was published on May 30, 2023 and has a CVSS 3.1 base score of 9.1 (CRITICAL).

This vulnerability has a CVSS 3.1 base score of 9.1, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

Technical description

Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewing at home and abroad on a broad range of client devices. This vulnerability may allow administrative access to an Emby Server system, depending on certain user account settings. By spoofing certain headers which are intended for interoperation with reverse proxy servers, it may be possible to affect the local/non-local network determination to allow logging in without password or to view a list of user accounts which may have no password configured. Impacted are all Emby Server system which are publicly accessible and where the administrator hasn't tightened the account login configuration for administrative users. This issue has been patched in Emby Server Beta version 4.8.31 and Emby Server version 4.7.12.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

GitHubgithub.com/EmbySupport/security/security/advisories/GHSA-fffj-6fr6-3fgfGitHubgithub.com/EmbySupport/security/security/advisories/GHSA-fffj-6fr6-3fgf

How CyberStrike helps

Frequently asked questions

What is CVE-2023-33193?

CVE-2023-33193 is a critical-severity vulnerability. It was published on May 30, 2023 and has a CVSS 3.1 base score of 9.1 (CRITICAL).

How severe is CVE-2023-33193?

This vulnerability has a CVSS 3.1 base score of 9.1, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

How do I fix or remediate CVE-2023-33193?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2023-33193?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2023-33193 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related CRITICAL CVEs from 2023

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999