CVE-2022-39305 Gin-vue-admin vulnerable to Unrestricted Upload of File with Dangerous Type
Attackers can upload arbitrary files due to missing validation, potentially leading to code execution or data access in Gin-vue-admin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-39305?
CVE-2022-39305 is a critical vulnerability in flipped-aurora gin-vue-admin, published on 24 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Versions prior to 2.5.4 contain a file upload ability. The affected code fails to validate fileMd5 and fileName parameters, resulting in an arbitrary file being read. This issue is patched in 2.5.4b. There are no known workarounds.
Weakness: CWE-434
Which versions are affected by CVE-2022-39305?
It affects 1 product.
Products include Gin-Vue-Admin Project Gin-Vue-Admin.
How do I fix CVE-2022-39305?
No fix has been published for CVE-2022-39305 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-39305 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-39305 exists.
Other vulnerabilities in flipped-aurora gin-vue-admin
- CVE-2022-39345 Gin-vue-admin arbitrary file upload vulnerability caused by path traversal
- CVE-2021-44219 SQL injection in n/a
- CVE-2022-32176 Gin-vue-admin - Unrestricted File Upload
- CVE-2022-32177 Gin-vue-admin - Unrestricted File Upload
- CVE-2025-66410 Gin-vue-admin has an arbitrary file deletion vulnerability
Sources
Also known as GHSA-wrmq-4v4c-gxp2.