GitHub Advisoryadvisory · Go

GHSA-hh54-53m7-7ffj alist Incorrect Access Control vulnerability

HIGH Published 2023-06-07 Modified 2023-06-13 Official page ↗
Aliases
CVE-2023-33498
Ecosystem
Go
Packages
github.com/alist-org/alist/v3
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2023-06-08

Affected packages

• Go github.com/alist-org/alist/v3: <= 3.16.3 (no fix yet)

Description

alist <=3.16.3 is vulnerable to Incorrect Access Control. Low privilege accounts can upload any file.

Related

Alias · CVE (1)

  • CVE-2023-33498 alist <=3.16.3 is vulnerable to Incorrect Access Control. vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References