CVE-2023-40020
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
PrivateUploader is an image hosting server that in affected versions did not correctly verify whether the user was an administrator or moderator. This led to processing requests even when the response indicated insufficient permissions.
Risk Assessment
The organization may be exposed to unauthorized changes or updates in the system, potentially leading to serious security breaches.
Recommendation
It is recommended to upgrade to version 3.2.49 to mitigate this vulnerability. There are no known workarounds for this issue.
Original NVD description (English source)
PrivateUploader is an open source image hosting server written in Vue and TypeScript. In affected versions `app/routes/v3/admin.controller.ts` did not correctly verify whether the user was an administrator (High Level) or moderator (Low Level) causing the request to continue processing. The response would be a 403 with ADMIN_ONLY, however, next() would call leading to any updates/changes in the route to process. This issue has been addressed in version 3.2.49. Users are advised to upgrade. There are no known workarounds for this vulnerability.