CVE-2021-43820

    Dashboard / Vulnerabilities / CVE-2021-43820

    CVE-2021-43820

    Published: 14 Dec 2021Last Modified: 9 Jul 2026

    Summary:

    Details: Seafile is an open source cloud storage system. A sync token is used in Seafile file syncing protocol to authorize access to library data. To improve performance, the token is cached in memory in seaf-server. Upon receiving a token from sync client or SeaDrive client, the server checks whether the token exist in the cache. However, if the token exists in cache, the server doesn't check whether it's associated with the specific library in the URL. This vulnerability makes it possible to use any valid sync token to access data from any **known** library. Note that the attacker has to first find out the ID of a library which it has no access to. The library ID is a random UUID, which is not possible to be guessed. There are no workarounds for this issue.

    References: https://github.com/haiwen/seafile-server/security/advisories/GHSA-m3wc-jv6r-hvv8, https://github.com/haiwen/seafile-server/pull/520

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -807867afb7a86f526a6584278914ce9f3f51d1da

    Affected versions

    v9.0.1-server
    v9.0.0-server

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-43820 | CVE-DB