In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3beta are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the 'Normal Upload' functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the admin’s cookie leading to account takeover.
References
| Link | Resource |
|---|---|
| https://github.com/flipped-aurora/gin-vue-admin/blob/v2.5.3beta/web/src/components/upload/common.vue#L29-L37 | Exploit Third Party Advisory |
| https://www.mend.io/vulnerability-database/CVE-2022-32177 | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
15 Nov 2022, 16:17
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-434 |
26 Oct 2022, 16:54
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.0 |
15 Oct 2022, 02:37
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| References | (MISC) https://www.mend.io/vulnerability-database/CVE-2022-32177 - Exploit, Third Party Advisory | |
| References | (CONFIRM) https://github.com/flipped-aurora/gin-vue-admin/blob/v2.5.3beta/web/src/components/upload/common.vue#L29-L37 - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| CPE | cpe:2.3:a:gin-vue-admin_project:gin-vue-admin:2.5.3:beta:*:*:*:*:*:* cpe:2.3:a:gin-vue-admin_project:gin-vue-admin:*:*:*:*:*:*:*:* |
|
| First Time |
Gin-vue-admin Project
Gin-vue-admin Project gin-vue-admin |
14 Oct 2022, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-10-14 07:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-32177
Mitre link : CVE-2022-32177
CVE.ORG link : CVE-2022-32177
JSON object : View
Products Affected
gin-vue-admin_project
- gin-vue-admin
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type