---
id: 4215
title: "[CVE-2018-9282] Subsonic 6.1.1 - Multiple Vulnerabilities"
cve: CVE-2018-9282
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/subsonic-6-1-1-advisory"
published_at: "2018-09-17T00:00:00Z"
tags: ["xss", "vulnerability", "session-hijacking", "subsonic", "cve-2018-9282", "media-server"]
phying_url: "https://phying.com/item/4215"
lang: en
---

# [CVE-2018-9282] Subsonic 6.1.1 - Multiple Vulnerabilities

## Summary

Subsonic 6.1.1 carries 14 stored and five reflected XSS instances across podcast, tag and settings features, letting authenticated users target administrators and steal sessions.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **CVE:** CVE-2018-9282
- **Published:** 2018-09-17T00:00:00Z
- **Original:** https://bishopfox.com/blog/subsonic-6-1-1-advisory
- **Phying News:** https://phying.com/item/4215