Vulnerability · Published Aug 14, 2023 · Assigned by GitHub_M

CVE-2023-40020Improper Authentication in PrivateUploader

Critical 9.9

In plain English

A critical-severity improper authentication in PrivateUploader from PrivateUploader. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)0.5%top 58.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

PrivateUploader is an open source image hosting server written in Vue and TypeScript. In affected versions `app/routes/v3/admin.controller.ts` did not correctly verify whether the user was an administrator (High Level) or moderator (Low Level) causing the request to continue processing. The response would be a 403 with ADMIN_ONLY, however, next() would call leading to any updates/changes in the route to process. This issue has been addressed in version 3.2.49. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
PrivateUploader	PrivateUploader	< 3.2.49

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H

References

https://github.com/PrivateUploader/PrivateUploader/security/advisories/GHSA-vhrw-2472-rrjx x_refsource_CONFIRM
https://github.com/PrivateUploader/PrivateUploader/commit/869657d61e3c7a518177106fe63ea483082b0d3e x_refsource_MISC