Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1wNHd3LWo0cHItcXc2cc4AA01M
RuoYi vulnerable to Cross-site Scripting
A vulnerability, which was classified as problematic, has been found in y_project RuoYi up to 4.7.7. Affected by this issue is the function uploadFilesPath
of the component File Upload
. The manipulation of the argument originalFilenames
leads to cross site scripting. The attack may be launched remotely. VDB-235118 is the identifier assigned to this vulnerability.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wNHd3LWo0cHItcXc2cc4AA01M
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: 10 months ago
Updated: 6 months ago
CVSS Score: 3.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Identifiers: GHSA-p4ww-j4pr-qw6q, CVE-2023-3815
References:
- https://nvd.nist.gov/vuln/detail/CVE-2023-3815
- https://gitee.com/y_project/RuoYi/issues/I7IL85
- https://vuldb.com/?ctiid.235118
- https://vuldb.com/?id.235118
- https://github.com/advisories/GHSA-p4ww-j4pr-qw6q
Affected Packages
maven:com.ruoyi:ruoyi
Affected Version Ranges: <= 4.7.7No known fixed version