Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/flipped-aurora/gin-vue-admin/server < 0.0.0-20240409100909-b1b7427c6ea6
Fixed in
0.0.0-20240409100909-b1b7427c6ea6· Vendor fix available
Issue
Impact "gin-vue-admin<=v2.6.1 has a code injection vulnerability in the backend. In the Plugin System - Plugin Template feature, an attacker can perform directory traversal by manipulating the 'plugName' parameter. They can create specific folders such as 'api', 'config', 'global', 'model', 'router', 'service', and 'main.go' function within the specified traversal directory. Moreover, the Go files within these folders can have arbitrary code inserted based on a specific PoC parameter." Affected code: https://github.com/flipped-aurora/gin-vue-admin/blob/746af378990ebf3367f8bb3d4e9684936df152e7/server/api/v1/system/sysautocode.go:239. Let's take a look at the method 'AutoPlug' within the 'AutoCodeApi' struct. The main reason for the existence of this vulnerability is the controllability of the PlugName field within the struct. POC： By performing directory traversal and creating directories such as api, config, global, model, router, and service within the gin-vue-admin/server…
Recommended action: Upgrade to 0.0.0-20240409100909-b1b7427c6ea6 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/flipped-aurora/gin-vue-admin/server < 2.5.4
Fixed in
2.5.4· Vendor fix available
Issue
Impact Gin-vue-admin < 2.5.4 has File upload vulnerabilities。 File upload vulnerabilities are when a web server allows users to upload files to its filesystem without sufficiently validating things like their name, type, contents, or size. Failing to properly enforce restrictions on these could mean that even a basic image upload function can be used to upload arbitrary and potentially dangerous files instead. This could even include server-side script files that enable remote code execution. Patches https://github.com/flipped-aurora/gin-vue-admin/pull/1264 Workarounds https://github.com/flipped-aurora/gin-vue-admin/pull/1264 References #1263 For more information The plugin installation function of Gin-Vue-Admin allows users to download zip packages from the plugin market and upload them for installation. This function has an arbitrary file upload vulnerability. A malicious attacker can upload a constructed zip package to traverse the directory and upload or overwrite arbitrary files…
Recommended action: Upgrade to 2.5.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.