CVE-2022-24843

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin 2.50 has arbitrary file read vulnerability due to a lack of parameter validation. This has been resolved in version 2.5.1. There are no known workarounds for this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
flipped-aurora	gin-vue-admin	< 2.5.1

References

https://github.com/flipped-aurora/gin-vue-admin/issues/1002Issue Tracking, Third Party Advisory
https://github.com/flipped-aurora/gin-vue-admin/pull/1024Patch, Third Party Advisory
https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-32gq-gj42-mw43Patch, Third Party Advisory
https://github.com/flipped-aurora/gin-vue-admin/issues/1002Issue Tracking, Third Party Advisory
https://github.com/flipped-aurora/gin-vue-admin/pull/1024Patch, Third Party Advisory
https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-32gq-gj42-mw43Patch, Third Party Advisory

Timeline

Published: Apr 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-248448.8Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. The problem occur CVE-2022-248459.8Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In affected versions, the return of `<iface>.returns_int128()`CVE-2022-248467.2GeoWebCache is a tile caching server implemented in Java. The GeoWebCache disk quota mechanism can perform an unchecked JNDI lookup, which i CVE-2022-248477.2GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mech CVE-2022-248488.8DHIS2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability CVE-2022-248496.5DisCatSharp is a Discord API wrapper for .NET. Users of versions 9.8.5, 9.8.6, 9.9.0 and previously published prereleases of 10.0.0 who have CVE-2022-24857.5Any attempt (good or bad) to log into AutomationDirect Stride Field I/O with a web browser may result in the device responding with its pass CVE-2022-248504.3Discourse is an open source platform for community discussion. A category's group permissions settings can be viewed by anyone that has acce CVE-2022-248514.8LDAP Account Manager (LAM) is an open source web frontend for managing entries stored in an LDAP directory. The profile editor tool has an e CVE-2022-248535.3Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as par CVE-2022-248548.8Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called `ATTACH DATABASE`, which a CVE-2022-248555.4Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development