CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 2CVE-2022-32176 – Gin-vue-admin - Unrestricted File Upload
https://notcve.org/view.php?id=CVE-2022-32176
In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3b are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the "Compress Upload" functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the admin's cookie leading to account takeover. En "Gin-Vue-Admin", las versiones v2.5.1 hasta v2.5.3b son vulnerables a la subida de archivos sin restricciones que conlleva a una ejecución de código javascript, mediante de la funcionalidad "Compress Upload" a la biblioteca multimedia. Cuando un usuario administrador visualiza el archivo subido, un atacante poco privilegiado conseguirá acceso a la cookie del administrador conllevando a una toma de control de la cuenta • https://github.com/flipped-aurora/gin-vue-admin/blob/v2.5.3beta/web/src/components/upload/image.vue#L43-L49 https://www.mend.io/vulnerability-database/CVE-2022-32176 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 2CVE-2022-32177 – Gin-vue-admin - Unrestricted File Upload
https://notcve.org/view.php?id=CVE-2022-32177
In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3beta are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the 'Normal Upload' functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the admin’s cookie leading to account takeover. En "Gin-Vue-Admin", versiones v2.5.1 hasta v2.5.3beta, son vulnerables a una subida de archivos sin restricciones que conlleva a una ejecución de código javascript, mediante la funcionalidad "Normal Upload" a la biblioteca de medios. Cuando un usuario administrador visualiza el archivo subido, un atacante de bajo privilegio obtendrá acceso a la cookie del administrador conllevando a una toma de la cuenta • https://github.com/flipped-aurora/gin-vue-admin/blob/v2.5.3beta/web/src/components/upload/common.vue#L29-L37 https://www.mend.io/vulnerability-database/CVE-2022-32177 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24843 – Path Traversal in github.com/flipped-aurora/gin-vue-admin
https://notcve.org/view.php?id=CVE-2022-24843
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin 2.50 has arbitrary file read vulnerability due to a lack of parameter validation. This has been resolved in version 2.5.1. There are no known workarounds for this issue. Gin-vue-admin es un sistema de administración de bambalinas basado en vue y gin, que separa la parte delantera y trasera de la pila completa. • https://github.com/flipped-aurora/gin-vue-admin/issues/1002 https://github.com/flipped-aurora/gin-vue-admin/pull/1024 https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-32gq-gj42-mw43 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2022-24844 – SQL Injection in github.com/flipped-aurora/gin-vue-admin
https://notcve.org/view.php?id=CVE-2022-24844
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. The problem occurs in the following code in server/service/system/sys_auto_code_pgsql.go, which means that PostgreSQL must be used as the database for this vulnerability to occur. Users must: Require JWT login） and be using PostgreSQL to be affected. This issue has been resolved in version 2.5.1. There are no known workarounds. • https://github.com/flipped-aurora/gin-vue-admin/pull/1024 https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-5g92-6hpp-w425 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 3CVE-2022-21660 – Missing authorization in gin-vue-admin
https://notcve.org/view.php?id=CVE-2022-21660
Gin-vue-admin is a backstage management system based on vue and gin. In versions prior to 2.4.7 low privilege users are able to modify higher privilege users. Authentication is missing on the `setUserInfo` function. Users are advised to update as soon as possible. There are no known workarounds. • https://github.com/UzJu/Gin-Vue-admin-poc-CVE-2022-21660 https://github.com/UzJu/CVE-2022-21660 https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-xxvh-9c87-pqjx • CWE-862: Missing Authorization •