CVE-2023-40020

ALTO 8.3CVE-2023-40020 · Published 14/08/2023 · updated 17/06/2026

In breve

CVE-2023-40020 è una vulnerabilità ALTO (CVSS 8.3) che riguarda privateuploader (troplo).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.49%, superiore al 42.1% delle vulnerabilità.
Correzione: aggiornare a 3.2.49 o successiva.

Package	Affected versions	Patched versions
privateuploader troplo	`< 3.2.49`	`3.2.49`

Description

PrivateUploader is an open source image hosting server written in Vue and TypeScript. In affected versions `app/routes/v3/admin.controller.ts` did not correctly verify whether the user was an administrator (High Level) or moderator (Low Level) causing the request to continue processing. The response would be a 403 with ADMIN_ONLY, however, next() would call leading to any updates/changes in the route to process. This issue has been addressed in version 3.2.49. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References

PrivateUploader/PrivateUploader commit 869657d · Patch
PrivateUploader/PrivateUploader security advisory · Patch

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free