CVE-2022-32065: RuoYi 4.7.3 Arbitrary File Upload Vulnerability
Summary
CVE-2022-32065: RuoYi 4.7.3 vulnerable to arbitrary file upload in background management module. Affects com.ruoyi:ruoyi versions < 4.7.4. Fixed in 4.7.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RuoYi is an open-source background management module developed using Maven. It provides various features for managing and monitoring applications. The vulnerability affects RuoYi version 4.7.3 and below, allowing attackers to upload arbitrary files through the background management module.
Vulnerability Detail
The vulnerability in RuoYi version 4.7.3 and below is an arbitrary file upload issue. Attackers can exploit this vulnerability by uploading a crafted HTML file, which can lead to the execution of arbitrary code. This can result in unauthorized access, data manipulation, or further compromise of the system.
How To Fix
Minimum fixed version
4.7.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is crucial to apply the recommended fix by upgrading to RuoYi version 4.7.4 or above.
Conclusion
The arbitrary file upload vulnerability in RuoYi version 4.7.3 and below can be exploited by attackers to execute arbitrary code. It is crucial to upgrade to RuoYi version 4.7.4 or above to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for com.ruoyi:ruoyi →
FAQ
The vulnerability allows attackers to execute arbitrary code, potentially leading to unauthorized access, data manipulation, or further compromise of the system.
RuoYi version 4.7.3 and below are affected by this vulnerability.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using the pom.xml file.
Yes, the CVSS score for this vulnerability is 5.4.
For more information about the vulnerability, you can refer to the GitHub advisory database (https://github.com/github/advisory-database).
References
Related vulnerabilities
Recent vulnerabilities recorded for com.ruoyi:ruoyi.
