PT-2023-18766 · Unknown · Librephotos

Published 2023-01-10 · Updated 2025-04-07 · CVE-2023-22903

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibrePhotos versions prior to e19e539

Description The issue is related to incorrect access control in the api/views/user.py file. This could potentially allow unauthorized access to certain features or data.

Recommendations For versions prior to e19e539, update to a version that includes the fix for the incorrect access control issue in api/views/user.py.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2023-22903

Affected Products

Librephotos

References · 7

• https://github.com/LibrePhotos/librephotos/commit/e19e539356df77f6f59e7d1eea22d452b268e120 · Patch
• https://osv.dev/vulnerability/CVE-2023-22903 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22903 · Security Note
• https://t.me/cvenotify/47002 · Telegram Post
• https://raw.githubusercontent.com/go-compile/security-advisories/master/CVE-2023-22903.pdf · Note
• https://t.me/cvenotify/118096 · Telegram Post
• https://t.me/cvenotify/41680 · Telegram Post