What is the CVSS score of CVE-2023-49801?

CVE-2023-49801 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Lif Auth Server are affected by CVE-2023-49801?

Organizations using Lif Auth Server should be aware of moderate risk from CVE-2023-49801, a path traversal vulnerability rated CVSS 4.2. This could allow unauthorized file access.. A patch is available.

How to fix or mitigate CVE-2023-49801?

During next maintenance window: Identify affected systems and apply vendor patches when convenient. Review file handling controls.

Lif Auth Server CVE-2023-49801

MEDIUM

Path Traversal (CWE-22)

2024-01-12 security-advisories@github.com

Path Traversal Lif Auth Server

4.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:34 vuln.today

Patch released

Mar 28, 2026 - 19:34 nvd

Patch available

CVE Published

Jan 12, 2024 - 21:15 nvd

MEDIUM 4.2

DescriptionGitHub Advisory

Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. The issue relates to the get_pfp and get_banner routes on Auth Server. The issue is that there is no check to ensure that the file that Auth Server is receiving through these URLs is correct. This could allow an attacker access to files they shouldn't have access to. This issue has been patched in version 1.4.0.

AnalysisAI

Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. Rated medium severity (CVSS 4.2), this vulnerability is remotely exploitable. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.

Technical ContextAI

This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. The issue relates to the get_pfp and get_banner routes on Auth Server. The issue is that there is no check to ensure that the file that Auth Server is receiving through these URLs is correct. This could allow an attacker access to files they shouldn't have access to. This issue has been patched in version 1.4.0. Affected products include: Lifplatforms Lif Auth Server. Version information: version 1.4.0..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.