Описание
In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the /system/user/resetPwd request.
Ссылки
- ExploitIssue TrackingThird Party Advisory
- ExploitIssue TrackingThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:ruoyi:ruoyi:4.7.2:*:*:*:*:*:*:*
EPSS
Процентиль: 33%
0.00127
Низкий
6.5 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-732
Связанные уязвимости
CVSS3: 6.5
github
больше 3 лет назад
In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the /system/user/resetPwd request.
EPSS
Процентиль: 33%
0.00127
Низкий
6.5 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-732