In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3b are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the "Compress Upload" functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the admin's cookie leading to account takeover.
References
| Link | Resource |
|---|---|
| https://github.com/flipped-aurora/gin-vue-admin/blob/v2.5.3beta/web/src/components/upload/image.vue#L43-L49 | Exploit Third Party Advisory |
| https://www.mend.io/vulnerability-database/CVE-2022-32176 | Exploit Third Party Advisory |
Configurations
History
26 Oct 2022, 16:54
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.0 |
20 Oct 2022, 12:45
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.mend.io/vulnerability-database/CVE-2022-32176 - Exploit, Third Party Advisory | |
| References | (MISC) https://github.com/flipped-aurora/gin-vue-admin/blob/v2.5.3beta/web/src/components/upload/image.vue#L43-L49 - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.0 |
| CPE | cpe:2.3:a:gin-vue-admin_project:gin-vue-admin:*:*:*:*:*:*:*:* | |
| First Time |
Gin-vue-admin Project
Gin-vue-admin Project gin-vue-admin |
17 Oct 2022, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-10-17 19:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-32176
Mitre link : CVE-2022-32176
CVE.ORG link : CVE-2022-32176
JSON object : View
Products Affected
gin-vue-admin_project
- gin-vue-admin
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type