Lucene search

GitHub_MCVE-2022-39305

HistoryOct 24, 2022 - 2:15 p.m.

CVE-2022-39305

2022-10-2414:15:51

CWE-434

GitHub_M

web.nvd.nist.gov

gin-vue-admin

vue

gin

security

vulnerability

file upload

cve-2022-39305

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.003

Percentile

68.3%

JSON

Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Versions prior to 2.5.4 contain a file upload ability. The affected code fails to validate fileMd5 and fileName parameters, resulting in an arbitrary file being read. This issue is patched in 2.5.4b. There are no known workarounds.

Affected configurations

Nvd

Node

gin-vue-admin_projectgin-vue-adminRange<2.5.4b

VendorProductVersionCPE
gin-vue-admin_projectgin-vue-admin*cpe:2.3:a:gin-vue-admin_project:gin-vue-admin:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
gin-vue-admin_project	gin-vue-admin	*	cpe:2.3:a:gin-vue-admin_project:gin-vue-admin::::::::

CNA Affected

[
  {
    "vendor": "flipped-aurora",
    "product": "gin-vue-admin",
    "versions": [
      {
        "version": "2.5.4b",
        "status": "affected"
      }
    ]
  }
]

References

github.com/flipped-aurora/gin-vue-admin/blob/main/server/utils/breakpoint_continue.go

github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-wrmq-4v4c-gxp2

Social References

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.003

Percentile

68.3%

JSON

Related for CVE-2022-39305