CVEvulnerability

CVE-2024-53617

4.8 MEDIUM Published 2024-12-02 Modified 2026-06-17 Official page ↗

Status: Deferred
Published: 2024-12-02
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 4.8 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses: CWE-639, CWE-79

Description

A Cross Site Scripting vulnerability in LibrePhotos before commit 32237 allows attackers to takeover any account via uploading an HTML file on behalf of the admin user using IDOR in file upload.

Weakness · CWE (2)

CWE-639 Authorization Bypass Through User-Controlled Key weakness
CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References

https://github.com/LibrePhotos/librephotos/commit/32237ddc0b6293a69b983a07b5ad462fcdd6c929 github.com
https://github.com/LibrePhotos/librephotos/pull/1476 github.com
https://github.com/ii5mai1/CVE-2024-53617 github.com

CVE-2024-53617

Description

Related

Weakness · CWE (2)

References