5.9

CVE-2024-31221

Exploit

Clients removed during unpairing process may regain access if Sunshine was not restarted

Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.10.0 and prior to version 0.23.0, after unpairing all devices in the web UI interface and then pairing only one device, all of the previously devices will be temporarily paired. Version 0.23.0 contains a patch for the issue. As a workaround, restarting Sunshine after unpairing all devices prevents the vulnerability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Lizardbyte ≫ Sunshine Version >= 0.10.0 < 0.23.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.51% 0.393
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 5.9 1.2 4.7
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L
CWE-384 Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

https://github.com/LizardByte/Sunshine/commit/b7aa8119f1471844dccdf73a8b6f7efc9baddb5e
Patch
https://github.com/LizardByte/Sunshine/issues/2305
Exploit
Issue Tracking
https://github.com/LizardByte/Sunshine/pull/2365
Patch
Issue Tracking
https://github.com/LizardByte/Sunshine/security/advisories/GHSA-v8gw-jw28-v55m
Vendor Advisory