CVE-2022-21660: Missing authorization in gin-vue-admin
Published Feb 9, 2022
·Updated
Gin-vue-admin is a backstage management system based on vue and gin. In versions prior to 2.4.7 low privilege users are able to modify higher privilege users. Authentication is missing on the setUserInfo function. Users are advised to update as soon as possible. There are no known workarounds.
Affected Software
1 affected component
Gin-vue-admin Project Gin-vue-admin<=2.4.6
Event History
Feb 9, 2022
CVE Published
via MITRE·07:55 PM
Data Sourced
via MITRE·07:55 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2022-21660.
2
What is the severity level of CVE-2022-21660?
CVE-2022-21660 has a severity level of 8.1, which is considered high.
3
What is the affected software?
The affected software is Gin-vue-admin version up to and including 2.4.6.
4
What is the impact of CVE-2022-21660?
The impact of CVE-2022-21660 is that low privilege users can modify higher privilege users.
5
How can I fix CVE-2022-21660?
To fix CVE-2022-21660, users are advised to update Gin-vue-admin to version 2.4.7 or later.