PT-2023-20906 · Ruoyi · Ruoyi

Superx · Published 2023-04-02 · Updated 2023-04-07 · CVE-2023-27025

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions RuoYi versions 4.7.6 and below

Description An arbitrary file download issue in the background management module allows attackers to download arbitrary files on the server.

Recommendations For versions 4.7.6 and below, update to a version above 4.7.6 to resolve the issue. As a temporary workaround, consider restricting access to the background management module until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-494

Related Identifiers

CVE-2023-27025

GHSA-H4C9-RR5M-32FM

Affected Products

Ruoyi

References · 9

• 🔥 https://gitee.com/y_project/RuoYi/issues/I697Q5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-27025 · Security Note
• https://osv.dev/vulnerability/GHSA-h4c9-rr5m-32fm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27025 · Vendor Advisory
• https://gitee.com/y_project/RuoYi · Note
• https://t.me/cibsecurity/61308 · Telegram Post
• https://t.me/cvenotify/47350 · Telegram Post
• https://t.me/cvenotify/47767 · Telegram Post
• https://gitee.com/y_project/RuoYi/commit/432d5ce1be2e9384a6230d7ccd8401eef5ce02b0 · Note