Casdoor arbitrary file write vulnerability

CRITICO 9.1CVE-2022-38638 · GHSA-9vm3-r8gq-cr6x · GO-2022-1006 · Published 09/09/2022 · updated 17/06/2026

In breve

CVE-2022-38638 è una vulnerabilità CRITICO (CVSS 9.1) che riguarda github.com/casdoor/casdoor, casdoor, casdoor (casbin).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.2%, superiore al 68.8% delle vulnerabilità.
Correzione: aggiornare a 1.103.1 o successiva.

Package	Affected versions	Patched versions
github.com/casdoor/casdoor Go	`< 1.103.1`	`1.103.1`
casdoor PyPI	`≤ 1.97.3`	No fix yet
casdoor casbin	`= 1.97.3`	No fix yet

Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource.

NVD description

Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

< 1.103.1

1.103.1

PyPI

≤ 1.97.3

No fix yet

= 1.97.3

No fix yet

Altre vulnerabilità di github.com/casdoor/casdoor

Vedi tutto →