Description

An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the server.

Remediation

References

https://gitee.com/y_project/RuoYi/commit/432d5ce1be2e9384a6230d7ccd8401eef5ce02b0

https://gitee.com/y_project/RuoYi/issues/I697Q5

Related Vulnerabilities

CVE-2023-35162 Vulnerability in maven package org.xwiki.platform:xwiki-platform-flamingo-skin-resources

CVE-2022-45688 Vulnerability in maven package cn.hutool:hutool-json

CVE-2023-45303 Vulnerability in maven package org.thingsboard:thingsboard

CVE-2023-3163 Vulnerability in maven package com.ruoyi:ruoyi-common

CVE-2020-7699 Vulnerability in npm package express-fileupload

Severity

High

Classification

CWE-494 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Permissions Required Exploit Issue Tracking