PT-2022-27404 · Unknown · Rainygao Docsys

Tgao · Published 2022-12-15 · Updated 2022-12-20 · CVE-2022-4511

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions RainyGao DocSys (affected versions not specified)

Description A critical issue has been found in RainyGao DocSys, affecting an unknown functionality of the component com.DocSystem.controller.UserController#getUserImg. The manipulation leads to path traversal, specifically '../filedir'. This issue can be exploited remotely.

Recommendations To fix this issue, it is recommended to apply a patch. As a temporary workaround, consider restricting access to the getUserImg function in the UserController component until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-4511

Affected Products

Rainygao Docsys

References · 5

• 🔥 https://gitee.com/RainyGao/DocSys/issues/I66A3V · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-4511 · Security Note
• https://t.me/cvenotify/39994 · Telegram Post
• https://t.me/cvenotify/40252 · Telegram Post
• https://vuldb.com/?id.215851 · Note