PT-2022-27703 · Alist · Alist

Shydlock · Published 2022-12-12 · Updated 2024-08-21 · CVE-2022-45968

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Alist version 3.4.0

Description The issue allows a user with only file upload permission to upload any file to any folder, including those that are password protected.

Recommendations For Alist version 3.4.0, update to version 3.5.1 to resolve the issue. As a temporary workaround, consider restricting file upload permissions to minimize the risk of exploitation.

Exploit

Fix

Improper Preservation of Permissions

Unrestricted File Upload

Weakness Enumeration

CWE-281

CWE-434

Related Identifiers

CVE-2022-45968

GHSA-4GJR-VGFX-9QVW

GO-2022-1161

Affected Products

Alist

References · 10

• 🔥 https://github.com/alist-org/alist/issues/2444 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-45968 · Security Note
• https://osv.dev/vulnerability/GHSA-4gjr-vgfx-9qvw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-45968 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-1161 · Vendor Advisory
• https://github.com/alist-org/alist/commit/85e1350af82e1759ca6580895e48ab969eb566cf · Note
• https://github.com/alist-org/alist · Note
• https://t.me/cibsecurity/54316 · Telegram Post
• https://t.me/cvenotify/39649 · Telegram Post
• https://github.com/advisories/GHSA-4gjr-vgfx-9qvw · Note