RuoYi vulnerable to arbitrary file download

Description

References

• nvd.nist.gov/vuln/detail/CVE-2023-27025 · ADVISORY
• gitee.com/y_project/RuoYi · WEB
• gitee.com/y_project/RuoYi/commit/432d5ce1be2e9384a6230d7ccd8401eef5ce02b0 · WEB
• gitee.com/y_project/RuoYi/issues/I697Q5 · WEB

Mais vulnerabilidades de com.ruoyi:ruoyi

• CVE-2024-57439MÉDIO 4.9An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service (DoS) by duplic…
• CVE-2024-57438MÉDIO 5.4Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles.
• CVE-2024-57436ALTO 7.2RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can all…
• CVE-2023-49371CRÍTICO 9.8RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit.
• CVE-2023-3815MÉDIO 6.1A vulnerability, which was classified as problematic, has been found in y_project RuoYi up to 4.7.7. Affected by this issue is the function …