RuoYi 4.7.3 vulnerable to arbitrary file upload in background management module

Description

References

• nvd.nist.gov/vuln/detail/CVE-2022-32065 · ADVISORY
• yangzongzhuan/RuoYi · WEB
• yangzongzhuan/RuoYi commit d8b2a9a · WEB
• gitee.com/y_project/RuoYi/commit/d8b2a9a905fb750fa60e2400238cf4750a77c5e6 · WEB
• gitee.com/y_project/RuoYi/issues/I57IME · WEB
• yangzongzhuan/RuoYi · WEB

More vulnerabilities in com.ruoyi:ruoyi

• CVE-2024-57439MEDIUM 4.9An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service (DoS) by duplic…
• CVE-2024-57438MEDIUM 5.4Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles.
• CVE-2024-57436HIGH 7.2RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can all…
• CVE-2023-49371CRITICAL 9.8RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit.
• CVE-2023-3815MEDIUM 6.1A vulnerability, which was classified as problematic, has been found in y_project RuoYi up to 4.7.7. Affected by this issue is the function …