CVE-2022-32177

Опубликовано: 14 окт. 2022

Источник: nvd

CVSS3: 9

EPSS Низкий

Описание

In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3beta are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the 'Normal Upload' functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the admin’s cookie leading to account takeover.

Ссылки

https://github.com/flipped-aurora/gin-vue-admin/blob/v2.5.3beta/web/src/components/upload/common.vue#L29-L37
Exploit
Third Party Advisory
https://www.mend.io/vulnerability-database/CVE-2022-32177
Exploit
Third Party Advisory
https://github.com/flipped-aurora/gin-vue-admin/blob/v2.5.3beta/web/src/components/upload/common.vue#L29-L37
Exploit
Third Party Advisory
https://www.mend.io/vulnerability-database/CVE-2022-32177
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:gin-vue-admin_project:gin-vue-admin:*:*:*:*:*:*:*:*

Версия от 2.5.1 (включая) до 2.5.2 (включая)

cpe:2.3:a:gin-vue-admin_project:gin-vue-admin:2.5.3:beta:*:*:*:*:*:*

EPSS

Процентиль: 71%

0.00668

Низкий

9 Critical

CVSS3

Дефекты

CWE-434

Связанные уязвимости

GHSA-ppw7-v579-v4cr