Vulnerability · Published Oct 17, 2022 · Assigned by Mend
CVE-2022-32176Gin-vue-admin - Unrestricted File Upload
Critical 9.0
In plain English
A critical-severity unrestricted file upload in gin-vue-admin from gin-vue-admin. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).
Severity (CVSS 3.1)9.0Critical
Exploit odds (30 days)1.3%top 29.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3b are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the "Compress Upload" functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the admin's cookie leading to account takeover.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| gin-vue-admin | gin-vue-admin | v2.5.1 – before unspecifiedunspecified – through v2.5.3b |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H