CVE-2023-49801

CVSS V2 None CVSS V3 None
Description
Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. The issue relates to the `get_pfp` and `get_banner` routes on Auth Server. The issue is that there is no check to ensure that the file that Auth Server is receiving through these URLs is correct. This could allow an attacker access to files they shouldn't have access to. This issue has been patched in version 1.4.0.
Overview
  • CVE ID
  • CVE-2023-49801
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-01-12T21:08:06.057Z
  • Last Modified Date
  • 2024-01-12T21:08:06.057Z
Weakness Enumerations
CWE URL
CWE-22 http://cwe.mitre.org/data/definitions/22.html
CWE-23 http://cwe.mitre.org/data/definitions/23.html
References
Reference URL Reference Tags
https://github.com/Lif-Platforms/Lif-Auth-Server/security/advisories/GHSA-3v77-pvqq-qg3f x_refsource_CONFIRM
https://github.com/Lif-Platforms/Lif-Auth-Server/commit/c235bcc2ee65e4a0dfb10284cf2cbc750213efeb x_refsource_MISC
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-49801
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49801
History
Created Old Value New Value Data Type Notes
2024-06-25 13:23:22 Added to TrackCVE