GitHub Advisoryadvisory · Maven

GHSA-v664-qgx9-wf79 RuoYi allowed unauthorized attackers to view the session ID of the admin in the system monitoring

HIGH Published 2025-01-29 Modified 2025-01-29 Official page ↗
Aliases
CVE-2024-57436
Ecosystem
Maven
Packages
com.ruoyi:ruoyi
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-200, CWE-922
Reviewed
2025-01-29

Affected packages

• Maven com.ruoyi:ruoyi: <= 4.8.0 (no fix yet)

Description

RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie.

Related

Alias · CVE (1)

  • CVE-2024-57436 RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-922 Insecure Storage of Sensitive Information weakness

References