CVE-2022-32176

Опубликовано: 17 окт. 2022

Источник: nvd

CVSS3: 9

EPSS Низкий

Описание

In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3b are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the "Compress Upload" functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the admin's cookie leading to account takeover.

Ссылки

https://github.com/flipped-aurora/gin-vue-admin/blob/v2.5.3beta/web/src/components/upload/image.vue#L43-L49
Exploit
Third Party Advisory
https://www.mend.io/vulnerability-database/CVE-2022-32176
Exploit
Third Party Advisory
https://github.com/flipped-aurora/gin-vue-admin/blob/v2.5.3beta/web/src/components/upload/image.vue#L43-L49
Exploit
Third Party Advisory
https://www.mend.io/vulnerability-database/CVE-2022-32176
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:gin-vue-admin_project:gin-vue-admin:*:*:*:*:*:*:*:*

Версия от 2.5.1 (включая) до 2.5.3b (включая)

EPSS

Процентиль: 69%

0.00611

Низкий

9 Critical

CVSS3

Дефекты

CWE-434

Связанные уязвимости

GHSA-5qph-282w-wqm2