GitHub Advisoryadvisory · Go

GHSA-4gjr-vgfx-9qvw AList vulnerable to Improper Preservation of Permissions

HIGH Published 2022-12-12 Modified 2022-12-14 Official page ↗

Aliases: CVE-2022-45968
Ecosystem: Go
Packages: github.com/alist-org/alist/v3
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-281, CWE-434
Reviewed: 2022-12-12

Affected packages

• Go github.com/alist-org/alist/v3: < 3.5.1 → fixed in 3.5.1

Description

Alist v3.4.0 is vulnerable to File Upload. A user with only file upload permission can upload any file to any folder (even a password protected one). Version 3.5.1 contains a patch.

Alias · CVE (1)

CVE-2022-45968 Alist v3.4.0 is vulnerable to File Upload. vulnerability

Weakness · CWE (2)

CWE-281 Improper Preservation of Permissions weakness
CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References

https://nvd.nist.gov/vuln/detail/CVE-2022-45968 advisory
https://github.com/alist-org/alist/issues/2444 web
https://github.com/alist-org/alist/commit/85e1350af82e1759ca6580895e48ab969eb566cf web
https://github.com/alist-org/alist package