CVE-2024-42787

This is a flaw in the way the system handles playlist titles and descriptions. It is like a playlist label that secretly contains instructions that run when someone reads the label, potentially letting an attacker act through that person’s browser.

This matters to you if you use or run Kashipara Music Management System and allow people to create or view playlists. An attacker can submit the harmful content without signing in, but it only becomes a risk when someone opens a playlist containing it.

Attackers would need to get someone to open a malicious playlist, and there is no confirmed active exploitation or public attack code. Treat this as an amber issue: restrict the exposed feature and seek vendor guidance promptly, especially if untrusted people can submit playlists.

Confirm whether Kashipara Music Management System is deployed, whether the save_playlist function is enabled, and whether playlist titles or descriptions are displayed to other users. No vendor patch or fixed release is currently available, so there is no target version or supported upgrade path to provide.

Until a fix is released, limit playlist creation to trusted accounts, remove public or untrusted access to playlist submission where practical, and inspect existing playlist titles and descriptions for injected HTML or script-like content. Remove suspicious entries, preserve relevant logs, and ask the vendor for a patched release and upgrade guidance.

Monitor web-server and application logs for unusual requests to /music/ajax.php?action=save_playlist, unexpected playlist edits, and reports of browser pop-ups, redirects, or sessions behaving unexpectedly. This CVE is not in CISA’s Known Exploited Vulnerabilities catalog, so no CISA remediation due date applies.

CVE-2024-42787 is CVSS 6.1 (Medium): CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. It is CWE-79 stored cross-site scripting in the playlist save endpoint, with injected title or description content executing when later rendered in a victim browser. CISA KEV does not list the CVE, no public exploit code is on record, and EPSS predicts a 0.5% likelihood (43rd percentile) with a flat trend. Exploit maturity is therefore low based on the available findings.