CVE-2022-39305

· CRITICALModified

← All CVEs

CVSS v3.1

9.8

EPSS

1.09%

Published

Oct 24, 2022

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Versions prior to 2.5.4 contain a file upload ability. The affected code fails to validate fileMd5 and fileName parameters, resulting in an arbitrary file being read. This issue is patched in 2.5.4b. There are no known workarounds.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-434CWE-434

Affected Products (1)

gin-vue-admin_project · gin-vue-admin (up to 2.5.4b)vulnerable

References (4)

https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/utils/breakpoint_continue.go

ExploitThird Party Advisory

https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-wrmq-4v4c-gxp2

ExploitPatchThird Party Advisory

https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/utils/breakpoint_continue.go

ExploitThird Party Advisory

https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-wrmq-4v4c-gxp2

ExploitPatchThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs