VULNERABILITY INTELLIGENCE
CVE-2024-53617
CVSS score4.8 MEDIUM
EPSS probability0.54%
CISA KEVNot currently listed
Published2024-12-02
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Description
A Cross Site Scripting vulnerability in LibrePhotos before commit 32237 allows attackers to takeover any account via uploading an HTML file on behalf of the admin user using IDOR in file upload.
Weakness classification
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CWE-639: Authorization Bypass Through User-Controlled Key