x/vulndb: potential Go vuln in github.com/flipped-aurora/gin-vue-admin: CVE-2022-39345

[GoVulnBot]

CVE-2022-39345 references github.com/flipped-aurora/gin-vue-admin, which may be a Go module.

Description:
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch for this issue. There are no workarounds aside from upgrading to a patched version.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2022-39345
• JSON: https://github.com/CVEProject/cvelist/tree/640265a83f2e25c341aab4c3f4d3b9354b89c1d9/2022/39xxx/CVE-2022-39345.json
• web: GHSA-7gc4-r5jr-9hxv
• web: [Bug]: gin-vue-admin存在安全漏洞 flipped-aurora/gin-vue-admin#1263
• fix: 增加自动化代码选择业务库功能，增加无边框页面功能。 flipped-aurora/gin-vue-admin#1264
• web: https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/service/system/sys_auto_code.go
• Imported by: https://pkg.go.dev/github.com/flipped-aurora/gin-vue-admin?tab=importedby

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/flipped-aurora/gin-vue-admin
    packages:
      - package: gin-vue-admin
description: |
    Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch for this issue. There are no workarounds aside from upgrading to a patched version.
cves:
  - CVE-2022-39345
references:
  - web: https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-7gc4-r5jr-9hxv
  - web: https://github.com/flipped-aurora/gin-vue-admin/issues/1263
  - fix: https://github.com/flipped-aurora/gin-vue-admin/pull/1264
  - web: https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/service/system/sys_auto_code.go

[gopherbot]

Change https://go.dev/cl/446356 mentions this issue: data/excluded: add GO-2022-1082.yaml

[gopherbot]

Change https://go.dev/cl/592774 mentions this issue: data/reports: unexclude 50 reports