GitHub Advisoryadvisory · Maven

GHSA-vp22-232w-h9x8 RuoYi-Cloud Cross-site Scripting vulnerability

MEDIUM Published 2022-12-08 Modified 2022-12-12 Official page ↗
Aliases
CVE-2022-4348
Ecosystem
Maven
Packages
com.ruoyi:ruoyi-common
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-12-12

Affected packages

• Maven com.ruoyi:ruoyi-common: <= 4.6.2 (no fix yet)

Description

A vulnerability was found in y_project RuoYi-Cloud. It has been rated as problematic. Affected by this issue is some unknown functionality of the component JSON Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-215108. A patch for this issue is available at https://gitee.com/y_project/RuoYi-Cloud/pulls/224.

Related

Alias · CVE (1)

  • CVE-2022-4348 A vulnerability was found in y_project RuoYi-Cloud. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References