What is GHSA-6w2f-6wq3-rjvf?

GHSA-6w2f-6wq3-rjvf is a security advisory published by GitHub Security Advisories with Medium severity. RuoYi 4.7.3 vulnerable to arbitrary file upload in background management module

Which CVE IDs does GHSA-6w2f-6wq3-rjvf cover?

GHSA-6w2f-6wq3-rjvf covers the following CVE IDs: CVE-2022-32065. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6w2f-6wq3-rjvf?

GHSA-6w2f-6wq3-rjvf has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-6w2f-6wq3-rjvf?

GHSA-6w2f-6wq3-rjvf affects 1 product, including: maven/com.ruoyi:ruoyi:\u003c 4.7.4.

GHSA-6w2f-6wq3-rjvfMediumCVSS 5.4

RuoYi 4.7.3 vulnerable to arbitrary file upload in background management module

Vendor

GitHub Security Advisories

Published

July 14, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-32065 →

📋 Description

An arbitrary file upload vulnerability in the background management module of RuoYi v4.7.3 and below allows attackers to execute arbitrary code via a crafted HTML file.

🎯 Affected products1

maven/com.ruoyi:ruoyi:< 4.7.4

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2022-32065
https://github.com/yangzongzhuan/RuoYi/issues/118
https://github.com/yangzongzhuan/RuoYi/commit/d8b2a9a905fb750fa60e2400238cf4750a77c5e6
https://gitee.com/y_project/RuoYi/commit/d8b2a9a905fb750fa60e2400238cf4750a77c5e6
https://gitee.com/y_project/RuoYi/issues/I57IME
https://github.com/advisories/GHSA-6w2f-6wq3-rjvf