« Volver al listado

CVE-2021-43820

Estado: ModificadaMedia (5.9)—

Seafile is an open source cloud storage system. A sync token is used in Seafile file syncing protocol to authorize access to library data. To improve performance, the token is cached in memory in seaf-server. Upon receiving a token from sync client or SeaDrive client, the server checks whether the token exist in the cache. However, if the token exists in cache, the server doesn't check whether it's associated with the specific library in the URL. This vulnerability makes it possible to use any valid sync token to access data from any **known** library. Note that the attacker has to first find out the ID of a library which it has no access to. The library ID is a random UUID, which is not possible to be guessed. There are no workarounds for this issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Seafile — Seafile Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-43820",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.4,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "haiwen",
          "product": "seafile-server",
          "versions": [
            {
              "status": "affected",
              "version": "Community Edition < 8.0.8"
            },
            {
              "status": "affected",
              "version": "Pro Edition < 8.0.15"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-12-14T19:15:07.617",
  "references": [
    {
      "url": "https://github.com/haiwen/seafile-server/pull/520",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/haiwen/seafile-server/security/advisories/GHSA-m3wc-jv6r-hvv8",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/haiwen/seafile-server/pull/520",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/haiwen/seafile-server/security/advisories/GHSA-m3wc-jv6r-hvv8",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Seafile is an open source cloud storage system. A sync token is used in Seafile file syncing protocol to authorize access to library data. To improve performance, the token is cached in memory in seaf-server. Upon receiving a token from sync client or SeaDrive client, the server checks whether the token exist in the cache. However, if the token exists in cache, the server doesn't check whether it's associated with the specific library in the URL. This vulnerability makes it possible to use any valid sync token to access data from any **known** library. Note that the attacker has to first find out the ID of a library which it has no access to. The library ID is a random UUID, which is not possible to be guessed. There are no workarounds for this issue."
    },
    {
      "lang": "es",
      "value": "Seafile es un sistema de almacenamiento en la nube de código abierto. En el protocolo de sincronización de archivos de Seafile es usado un token de sincronización para autorizar el acceso a los datos de la biblioteca. Para mejorar el rendimiento, el token es almacenado en la memoria del servidor Seaf. Al recibir un token del cliente de sincronización o del cliente SeaDrive, el servidor comprueba si el token se presenta en la caché. Sin embargo, si el token se presenta en la caché, el servidor no comprueba si está asociado a la biblioteca específica en la URL. Esta vulnerabilidad permite usar cualquier token de sincronización válido para acceder a los datos de cualquier biblioteca **known**. Tenga en cuenta que el atacante debe averiguar primero el ID de una biblioteca a la que no presenta acceso. El ID de la biblioteca es un UUID aleatorio, que no es posible adivinar. No se presentan soluciones para este problema"
    }
  ],
  "lastModified": "2026-06-17T04:11:30.490",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:seafile:seafile_server:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "58002BD3-0F91-43BA-B2A5-795057DAEA71",
              "versionEndExcluding": "8.0.8"
            },
            {
              "criteria": "cpe:2.3:a:seafile:seafile_server:*:*:*:*:professional:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "23BB449E-446B-490F-982B-FD5720302333",
              "versionEndExcluding": "8.0.15"
            },
            {
              "criteria": "cpe:2.3:a:seafile:seafile_server:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "54565D96-E035-4CB3-8AF0-8ED3EB98D81B",
              "versionEndExcluding": "9.0.2",
              "versionStartIncluding": "9.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}