PT-2023-20906 · Ruoyi · Ruoyi

Superx · Publicado 2023-04-02 · Atualizado 2023-04-07 · CVE-2023-27025

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions RuoYi versions 4.7.6 and below

Description An arbitrary file download issue in the background management module allows attackers to download arbitrary files on the server.

Recommendations For versions 4.7.6 and below, update to a version above 4.7.6 to resolve the issue. As a temporary workaround, consider restricting access to the background management module until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-494

Identificadores relacionados

CVE-2023-27025

GHSA-H4C9-RR5M-32FM

Produtos afetados

Ruoyi

Referências · 9

• 🔥 https://gitee.com/y_project/RuoYi/issues/I697Q5 · Exploit
• https://gitee.com/y_project/RuoYi · Nota
• https://t.me/cibsecurity/61308 · Publicação no Telegram
• https://t.me/cvenotify/47350 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-27025 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-h4c9-rr5m-32fm · Aviso do Fabricante
• https://t.me/cvenotify/47767 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-27025 · Aviso do Fabricante
• https://gitee.com/y_project/RuoYi/commit/432d5ce1be2e9384a6230d7ccd8401eef5ce02b0 · Nota