x/vulndb: potential Go vuln in github.com/alist-org/alist/v3: GHSA-hh54-53m7-7ffj

[GoVulnBot]

In GitHub Security Advisory GHSA-hh54-53m7-7ffj, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/alist-org/alist/v3		<= 3.16.3

Cross references:

• Module github.com/alist-org/alist/v3 appears in issue x/vulndb: potential Go vuln in github.com/alist-org/alist/v3: GHSA-4gjr-vgfx-9qvw #1161 EFFECTIVELY_PRIVATE
• Module github.com/alist-org/alist/v3 appears in issue x/vulndb: potential Go vuln in github.com/alist-org/alist/v3: GHSA-957m-g6rf-4c2m #1162 NOT_A_VULNERABILITY
• Module github.com/alist-org/alist/v3 appears in issue x/vulndb: potential Go vuln in github.com/alist-org/alist/v3: GHSA-pmg2-rph8-p8r6 #1171 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/alist-org/alist/v3
      versions:
        - {}
      packages:
        - package: github.com/alist-org/alist/v3
summary: alist Incorrect Access Control vulnerability
description: alist <=3.16.3 is vulnerable to Incorrect Access Control. Low privilege accounts can upload any file.
cves:
    - CVE-2023-33498
ghsas:
    - GHSA-hh54-53m7-7ffj
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2023-33498
    - web: https://github.com/YUyuanAN-com/loophole
    - advisory: https://github.com/advisories/GHSA-hh54-53m7-7ffj

[gopherbot]

Change https://go.dev/cl/503837 mentions this issue: data/excluded: batch add 21 excluded reports

[gopherbot]

Change https://go.dev/cl/592761 mentions this issue: data/reports: unexclude 75 reports