GHSA-6w2f-6wq3-rjvf

RuoYi 4.7.3 vulnerable to arbitrary file upload in background management module

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-32065

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.ruoyi:ruoyi	< 4.7.4	4.7.4

Details

As written in the advisory (Markdown source, shown as plain text).

An arbitrary file upload vulnerability in the background management module of RuoYi v4.7.3 and below allows attackers to execute arbitrary code via a crafted HTML file.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-32065 advisory
https://github.com/yangzongzhuan/RuoYi/issues/118 web
https://github.com/yangzongzhuan/RuoYi/commit/d8b2a9a905fb750fa60e2400238cf4750a77c5e6 web
https://gitee.com/y_project/RuoYi/commit/d8b2a9a905fb750fa60e2400238cf4750a77c5e6 web
https://gitee.com/y_project/RuoYi/issues/I57IME web
https://github.com/yangzongzhuan/RuoYi web