RuoYi-Vue vulnerabilities

In yangzongzhuan RuoYi-Vue up to 3.9.2, the SysPermissionService.getMenuPermission function in SysPermissionService.java of the Permission Service component allows manipulation of the perms argument leading to improper privilege management. The attack can be initiated remotely; the vendor did not respond to the disclosure.

RuoYi-Vue up to version 3.9.2 has a path traversal vulnerability in the fileDownload/resourceDownload function in CommonController.java. Manipulation of the fileName/resource argument allows remote attack, and the exploit has been made public.

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2 in the FileUploadUtils.upload function in the /common/upload file of the Common Upload Endpoint component. Manipulation leads to unrestricted upload. The attack can be launched remotely. The vendor did not respond.