GitHub Advisoryadvisory · Maven

GHSA-6w2f-6wq3-rjvf RuoYi 4.7.3 vulnerable to arbitrary file upload in background management module

MEDIUM Published 2022-07-14 Modified 2022-07-29 Official page ↗
Aliases
CVE-2022-32065
Ecosystem
Maven
Packages
com.ruoyi:ruoyi
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-434, CWE-79
Reviewed
2022-07-15

Affected packages

• Maven com.ruoyi:ruoyi: < 4.7.4 → fixed in 4.7.4

Description

An arbitrary file upload vulnerability in the background management module of RuoYi v4.7.3 and below allows attackers to execute arbitrary code via a crafted HTML file.

Related

Alias · CVE (1)

  • CVE-2022-32065 An arbitrary file upload vulnerability in the background management module of RuoYi v4.7.3 and below allows attackers to execute arbitrary… vulnerability

Weakness · CWE (2)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References