CVE-2022-24739

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured). The impact is mitigated by the fact the SSRF attack is only possible when the `stream` option is enabled in the configuration. (This option is disabled by default.) 3.0.3 contains a fix for this vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601 CWE-918

Affected software

Vendor	Product	Versions
Rudloff	alltube	< 3.0.3

References

https://github.com/Rudloff/alltube/commit/3a4f09dda0a466662a4e52cde674749e0c668e8dPatch, Third Party Advisory
https://github.com/Rudloff/alltube/commit/8913f27716400dabf4906a5ad690a5238f73496aPatch, Third Party Advisory
https://github.com/Rudloff/alltube/commit/bc14b6e45c766c05757fb607ef8d444cbbfba71aPatch, Third Party Advisory
https://github.com/Rudloff/alltube/security/advisories/GHSA-75p7-527p-w8wpPatch, Third Party Advisory
https://github.com/Rudloff/alltube/commit/3a4f09dda0a466662a4e52cde674749e0c668e8dPatch, Third Party Advisory
https://github.com/Rudloff/alltube/commit/8913f27716400dabf4906a5ad690a5238f73496aPatch, Third Party Advisory
https://github.com/Rudloff/alltube/commit/bc14b6e45c766c05757fb607ef8d444cbbfba71aPatch, Third Party Advisory
https://github.com/Rudloff/alltube/security/advisories/GHSA-75p7-527p-w8wpPatch, Third Party Advisory

Timeline

Published: Mar 8, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-24748.0Authentication is currently unsupported in Haas Controller version 100.20.000.1110 when using the “Ethernet Q Commands” service, which allow CVE-2022-247407.5Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could CVE-2022-247416.5Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of servic CVE-2022-247425.5Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab CVE-2022-247438.2Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the pa CVE-2022-247443.5Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user session CVE-2022-247456.5Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessio CVE-2022-247466.1Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions it is possib CVE-2022-247475.3Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do CVE-2022-247487.5Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it i CVE-2022-247496.1Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containi CVE-2022-24758.8Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q Commands" service. Any use