medium5.4
CVE-2022-32065
RuoYi 4.7.3 vulnerable to arbitrary file upload in background management module
Impact
An arbitrary file upload vulnerability in the background management module of RuoYi v4.7.3 and below allows attackers to execute arbitrary code via a crafted HTML file.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.ruoyi:ruoyi | < 4.7.4 | 4.7.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ruoyi | Ruoyi | through 4.7.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://gitee.com/y_project/RuoYi/commit/d8b2a9a905fb750fa60e2400238cf4750a77c5e6
- https://gitee.com/y_project/RuoYi/issues/I57IME
- https://github.com/yangzongzhuan/RuoYi/commit/d8b2a9a905fb750fa60e2400238cf4750a77c5e6
- https://github.com/yangzongzhuan/RuoYi/issues/118
- https://github.com/advisories/GHSA-6w2f-6wq3-rjvf
- https://nvd.nist.gov/vuln/detail/CVE-2022-32065