| शीर्षक | guojusoft JeecgBoot v3.8.0 Resource Consumption |
|---|
| विवरण | A ZIP bomb vulnerability has been identified in JeecgBoot 3.8.0, specifically in the document upload feature of its AI knowledge base module. Attackers can exploit this by uploading a maliciously crafted ZIP file, which, when decompressed, consumes excessive system resources (e.g., disk space) and potentially causes service disruption. The root cause lies in the lack of restrictions on the total size and number of files during decompression in the unzipFile method. |
|---|
| स्रोत | ⚠️ https://github.com/jeecgboot/JeecgBoot/issues/8199 |
|---|
| उपयोगकर्ता | lem0n817 (UID 84709) |
|---|
| सबमिशन | 27/04/2025 10:49 AM (1 वर्ष पहले) |
|---|
| संयम | 10/05/2025 07:51 AM (13 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 308278 [JeecgBoot तक 3.8.0 Document Library Upload zip unzipFile file सेवा अस्वीकार] |
|---|
| अंक | 20 |
|---|