PT-2024-35792 · Unknown · Librephotos

Ii5Mai1 · Published 2024-11-29 · Updated 2024-12-02 · CVE-2024-53617

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LibrePhotos versions prior to commit 32237

Description A Cross Site Scripting issue allows attackers to takeover any account via uploading an HTML file on behalf of the admin user using IDOR in file upload. This is achieved by exploiting the file upload functionality, enabling attackers to gain control of any account.

Recommendations For versions prior to commit 32237, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting file uploads to prevent potential exploitation. Avoid using the file upload feature until the issue is resolved.

Exploit

Fix

IDOR

XSS

Weakness Enumeration

CWE-639

CWE-79

Related Identifiers

CVE-2024-53617

Affected Products

Librephotos

References · 9

• 🔥 https://github.com/ii5mai1/CVE-2024-53617 · Exploit
• https://osv.dev/vulnerability/CVE-2024-53617 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53617 · Security Note
• https://github.com/LibrePhotos/librephotos/pull/1476 · Note
• https://github.com/LibrePhotos/librephotos/commit/32237ddc0b6293a69b983a07b5ad462fcdd6c929 · Note
• https://twitter.com/VulmonFeeds/status/1862639563685937266 · Twitter Post
• https://t.me/cvenotify/102819 · Telegram Post
• https://twitter.com/CVEnew/status/1863658233271030051 · Twitter Post
• https://t.me/cvedetector/11815 · Telegram Post