low3.5
CVE-2023-3815
RuoYi vulnerable to Cross-site Scripting
Impact
A vulnerability, which was classified as problematic, has been found in y_project RuoYi up to 4.7.7. Affected by this issue is the function `uploadFilesPath` of the component `File Upload`. The manipulation of the argument `originalFilenames` leads to cross site scripting. The attack may be launched remotely. VDB-235118 is the identifier assigned to this vulnerability.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.ruoyi:ruoyi | <= 4.7.7 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ruoyi | Ruoyi | through 4.7.7 |