CVE-2022-39305

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-39305
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39305.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-39305
Aliases
  • GHSA-wrmq-4v4c-gxp2
Published
2022-10-24T00:00:00Z
Modified
2026-07-15T01:49:07.505100105Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Gin-vue-admin vulnerable to Unrestricted Upload of File with Dangerous Type
Details

Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Versions prior to 2.5.4 contain a file upload ability. The affected code fails to validate fileMd5 and fileName parameters, resulting in an arbitrary file being read. This issue is patched in 2.5.4b. There are no known workarounds.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39305.json",
    "cwe_ids": [
        "CWE-434"
    ]
}
References

Affected packages

Git / github.com/flipped-aurora/gin-vue-admin

Affected ranges

Type
GIT
Repo
https://github.com/flipped-aurora/gin-vue-admin
Events
Introduced
3ec4823533a1356b76eed5fc1a33432a77d97aea
Fixed
3ec4823533a1356b76eed5fc1a33432a77d97aea
Database specific 
{
    "cpe": "cpe:2.3:a:gin-vue-admin_project:gin-vue-admin:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.5.4b"
        },
        {
            "last_affected": "2.5.4b"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "2.5.4b"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

2.*
2.5.4b

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39305.json"