ClipBucket 5.5.3 Security Release: RCE, SQLi, XSS, and Privilege Escalation Fixes

Vulnerability Overview This page contains the release notes (Release #182) for version 5.5.3 of the clipbucket-v5 project, primarily addressing multiple security vulnerabilities, including XSS, SQL injection, RCE, privilege escalation, and unauthorized access. Scope of Impact Front Office: - Fixed potential XSS injection (#881) - Fixed missing CSS file - Fixed password reset form (#895) Back Office: - Fixed potential privilege escalation via user tier management (thanks to @ly8h) - Fixed potential privilege escalation via user impersonation (thanks to @QwesRED) - Fixed configuration loss caused by configuration changes - Fixed collection item management issues Conversion: - Fixed compatibility issues with HDR raw files Installation: - Fixed potential RCE (Remote Code Execution) (thanks to @QwesRED) Translations: - Translated hardcoded text Miscellaneous: - Fixed potential SQL injection (thanks to @de3rve-hunter) - Fixed video deletion issues - Fixed unauthorized video thumbnail overwrite (thanks to @de3rve-hunter) - Fixed potential SQL injection (thanks to @QwesRED) - Fixed potential RCE (thanks to @QwesRED) - Fixed nginx virtual host rules Remediation XSS Injection: Fixed potential XSS injection in the front office (#881) SQL Injection: Fixed potential SQL injection (thanks to @de3rve-hunter and @QwesRED) RCE (Remote Code Execution): Fixed potential RCE during installation (thanks to @QwesRED) Privilege Escalation: Fixed privilege escalation issues via user tier management and user impersonation (thanks to @ly8h and @QwesRED) Unauthorized Access: Fixed unauthorized video thumbnail overwrite issue (thanks to @de3rve-hunter) Others: Fixed missing CSS file, password reset form, configuration loss, collection item management, HDR compatibility, and nginx virtual host rules PoC Code or Exploit Code The page does not contain specific PoC code or exploit code blocks.

Goal Reached Thanks to every supporter — we hit 100%!

ClipBucket 5.5.3 Security Release: RCE, SQLi, XSS, and Privilege Escalation Fixes

More from this source