PT-2022-21140 · Unknown · Gin-Vue-Admin

Published 2022-10-14 · Updated 2025-05-14 · CVE-2022-32177

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gin-Vue-Admin versions v2.5.1 through v2.5.3beta

Description The issue allows for Unrestricted File Upload, leading to the execution of javascript code through the 'Normal Upload' functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker can gain access to the admin's cookie, resulting in account takeover.

Recommendations For versions v2.5.1 through v2.5.3beta, consider disabling the 'Normal Upload' functionality to the Media Library until a patch is available to prevent Unrestricted File Upload and potential account takeover. Restrict access to the Media Library to minimize the risk of exploitation. Avoid using the 'Normal Upload' feature in the affected versions to prevent the execution of malicious javascript code.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-32177

Affected Products

Gin-Vue-Admin

References · 6

• 🔥 https://github.com/flipped-aurora/gin-vue-admin/blob/v2.5.3beta/web/src/components/upload/common.vue#L29-L37 · Exploit
• 🔥 https://mend.io/vulnerability-database/CVE-2022-32177 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-32177 · Security Note
• https://osv.dev/vulnerability/CVE-2022-32177 · Vendor Advisory
• https://t.me/cvenotify/37765 · Telegram Post
• https://t.me/cvenotify/122155 · Telegram Post