CVE-2022-32177
Last modified
CVE-2022-32177 is a critical-severity vulnerability rated 9/10 on the CVSS scale. In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3beta are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the 'Normal Upload' functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the admin’s cookie leading to account takeover.. EPSS estimates a 0.95% chance of exploitation in the next 30 days.
Description
In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3beta are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the 'Normal Upload' functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the admin’s cookie leading to account takeover.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Gin-Vue-Admin Project | Gin-Vue-Admin | >= 2.5.1, <= 2.5.2 | — |
| Gin-Vue-Admin Project | Gin-Vue-Admin | 2.5.3 | Beta |
References
- https://github.com/flipped-aurora/gin-vue-admin/blob/v2.5.3beta/web/src/components/upload/common.vue#L29-L37Exploit, Third Party Advisory
- https://www.mend.io/vulnerability-database/CVE-2022-32177Exploit, Third Party Advisory
- https://github.com/flipped-aurora/gin-vue-admin/blob/v2.5.3beta/web/src/components/upload/common.vue#L29-L37Exploit, Third Party Advisory
- https://www.mend.io/vulnerability-database/CVE-2022-32177Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-32177?
How severe is CVE-2022-32177?
How do I fix CVE-2022-32177?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-32171In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to St…
- CVE-2022-32172In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to St…
- CVE-2022-32173In OrchardCore rc1-11259 to v1.2.2 vulnerable to HTML inject…5.4
- CVE-2022-32174In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to …9
- CVE-2022-32175In AdGuardHome, versions v0.95 through v0.108.0-b.13 are vul…5.4
- CVE-2022-32176In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3b are vuln…9
- CVE-2022-3218Due to a reliance on client-side authentication, the WiFi Mo…9.8
- CVE-2022-32189A too-short encoded message can cause a panic in Float.GobDe…7.5
- CVE-2022-3219GnuPG can be made to spin on a relatively small input by (fo…3.3
- CVE-2022-32190JoinPath and URL.JoinPath do not remove ../ path elements ap…7.5
- CVE-2022-32191Rejected reason: reserved but not needed
- CVE-2022-32192Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensit…7.5
Are you affected by CVE-2022-32177?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST