CVE-2020-15153: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2020-15153 affects Ampache versions before 4.2.2, allowing unauthenticated users to perform SQL injection attacks. The vulnerability was discovered in the database_object.abstract.php component and was fixed in version 4.2.2 and the development branch (GitHub Advisory, NVD).

The vulnerability received a CVSS v3.1 Base Score of 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) from NIST and 8.2 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) from GitHub. The issue was classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (NVD).

The SQL injection vulnerability allows unauthenticated attackers to execute arbitrary SQL commands against the database, potentially leading to unauthorized access to sensitive data, modification of database contents, and compromise of the application's security (GitHub Advisory).

The vulnerability was fixed in Ampache version 4.2.2. Users should upgrade to this version or later to protect against this security issue. The fix includes proper input validation and parameter handling in the database_object.abstract.php component (Ampache Release).