CVE-2023-49801CWE-22CWE-23

Lif Auth Server vulnerable to uncontrolled data in path expression

Medium · published January 12, 2024

CVSS v3.1
4.2
EPSS
0%
Percentile
30.3
In the wild
Unconfirmed
What it is

Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. The issue relates to the `get_pfp` and `get_banner` routes on Auth Server. The issue is that there is no check to ensure that the file that Auth Server is receiving through these URLs is correct. This could allow an attacker access to files they shouldn't have access to. This issue has been patched in version 1.4.0.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00376 · 30.3th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-23 · Relative Path Traversal
Published
2024-01-12T21:08Z
EPSS history
Timeline
  • 12 JAN 21:08Z
    Lif Auth Server vulnerable to uncontrolled data in path expression
    cvelistv5