PT-2022-16301 · Ruoyi · Ruoyi

Sanlang · Published 2022-03-30 · Updated 2022-04-04 · CVE-2022-23869

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions RuoYi versions 4.7.2

Description The issue allows a user without permission to reset another user's password through a specific API endpoint. Specifically, user test1 does not have permission to reset the password of user test3 via the WebUI, but can do so through the "/system/user/resetPwd" API endpoint.

Recommendations For RuoYi version 4.7.2, as a temporary workaround, consider restricting access to the "/system/user/resetPwd" API endpoint to prevent unauthorized password resets. Additionally, review and adjust the permission settings to ensure that only authorized users can reset passwords. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2022-23869

Affected Products

Ruoyi

References · 4

• 🔥 https://gitee.com/y_project/RuoYi/issues/I4RCO2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-23869 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23869 · Vendor Advisory
• https://t.me/cibsecurity/39802 · Telegram Post