9

CVE-2022-32177

Exploit

Gin-vue-admin - Unrestricted File Upload

In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3beta are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the 'Normal Upload' functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the admin’s cookie leading to account takeover.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gin-vue-admin Project ≫ Gin-vue-admin Version >= 2.5.1 <= 2.5.2
Gin-vue-admin Project ≫ Gin-vue-admin Version2.5.3 Updatebeta
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.95% 0.564
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9 2.3 6
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 9 2.3 6
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

https://github.com/flipped-aurora/gin-vue-admin/blob/v2.5.3beta/web/src/components/upload/common.vue#L29-L37
Third Party Advisory
Exploit
https://www.mend.io/vulnerability-database/CVE-2022-32177
Third Party Advisory
Exploit