CyberRota Analysis
AI-GeneratedCloudreve versions prior to 4.17.0 are vulnerable due to inadequate validation of WOPI access tokens, allowing attackers with a valid view session to forge token suffixes and execute unauthorized write actions on files. This can lead to data manipulation or unauthorized access to sensitive information. Organizations using affected versions should prioritize upgrading to version 4.17.0 to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token and does not enforce the requested viewer action, allowing a malicious or compromised WOPI viewer with a view session to forge the token suffix and invoke WOPI write routes for the underlying file. This issue is fixed in version 4.17.0.