Lucene search

[email protected]NVD:CVE-2023-52082

HistoryDec 28, 2023 - 4:16 p.m.

CVE-2023-52082

2023-12-2816:16:02

CWE-89

[email protected]

web.nvd.nist.gov

lychee

photo-management

sql injection

vulnerability

patch

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

33.0%

JSON

Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the .env settings set to DB_LOG_SQL=true and DB_LOG_SQL_EXPLAIN=true. The defaults settings of Lychee are safe. The patch is provided on version 5.0.2. To work around this issue, disable SQL EXPLAIN logging.

Affected configurations

Nvd

Node

lycheeorglycheeRange4.9.3–5.0.2

VendorProductVersionCPE
lycheeorglychee*cpe:2.3:a:lycheeorg:lychee:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
lycheeorg	lychee	*	cpe:2.3:a:lycheeorg:lychee::::::::

References

github.com/LycheeOrg/Lychee/commit/33354a2ce7cf700cc4ee537b7b8b94dfc1e84ad4

github.com/LycheeOrg/Lychee/security/advisories/GHSA-rjwv-5j3m-p5x4

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

33.0%

JSON

Related for NVD:CVE-2023-52082

cve1 prion1 cvelist1 osv1