PT-2026-99568 · Cloudreve · Cloudreve
CVSS v4.0
6.9
متوسطة
| المتجه | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Cloudreve versions prior to 4.16.1
Description
The software fails to revalidate share access when restoring cached navigator state from a
context hint UUID. This allows attackers who previously held valid share access to replay the cached hint to generate signed file URLs for up to 300 seconds after the share has been deleted, expired, or reached the limit of remaining downloads.Recommendations
Update to version 4.16.1 or later.
استغلال
إصلاح
Incorrect Authorization
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Cloudreve