VULNERABILITY INTELLIGENCE

CVE-2017-9355

CVSS score7.4 HIGH
EPSS probability26.91%
CISA KEVNot currently listed
Published2017-06-07
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Description

XML external entity (XXE) vulnerability in the import playlist feature in Subsonic 6.1.1 might allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted XSPF playlist file.

Weakness classification

  • CWE-918: Server-Side Request Forgery (SSRF)

Primary references