CVE-2023-40020
Critical
Description
PrivateUploader is an open source image hosting server written in Vue and TypeScript. In affected versions `app/routes/v3/admin.controller.ts` did not correctly verify whether the user was an administrator (High Level) or moderator (Low Level) causing the request to continue processing. The response would be a 403 with ADMIN_ONLY, however, next() would call leading to any updates/changes in the route to process. This issue has been addressed in version 3.2.49. Users are advised to upgrade. There are no known workarounds for this vulnerability.
SeverityCritical
CVSS9.9
Exploit probability—
ProductTroplo Privateuploader
PublishedAug 14, 2023
First seenAug 14, 2023
Weakness typeCWE-287Improper authentication
How to fix
Update
- troplo privateuploader3.2.49 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| troplo privateuploader | v < 3.2.49 | 3.2.49 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.