What is CVE-2022-23869?

CVE-2022-23869 is a medium-severity vulnerability in Ruoyi, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 6.5/10. Published 2022-03-30.

How severe is CVE-2022-23869?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Ruoyi

CVE-2022-23869

In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the /system/user/resetPwd request.

EPSS: 0.007 (48.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.

Affected products

Ruoyi — versions 4.7.2
N/a — versions n/a

Weakness classification (CWE)

CWE-732 — Incorrect Permission Assignment for Critical Resource

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC, Issue Tracking)

Frequently asked questions

What is CVE-2022-23869?: CVE-2022-23869 is a medium-severity vulnerability in Ruoyi, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 6.5/10. Published 2022-03-30.
How severe is CVE-2022-23869?: Medium severity. CVSS v3 base score is 6.5 out of 10.