VULNERABILITY INTELLIGENCE

CVE-2022-32176

CVSS score9 CRITICAL
EPSS probability1.27%
CISA KEVNot currently listed
Published2022-10-17
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Description

In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3b are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the "Compress Upload" functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the admin's cookie leading to account takeover.

Weakness classification

  • vulnerabilitylab@mend.io: CWE-434
  • nvd@nist.gov: CWE-434

Primary references