CVE-2024-57436

State: Published
Severity: 7.2 High
Published: Jan 29, 2025
Updated: Jan 29, 2025
Reserved: Jan 9, 2025

Description

RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-922 Insecure Storage of Sensitive Information

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://github.com/yangzongzhuan/RuoYi
https://ruoyi.vip/
https://github.com/peccc/restful_vul/blob/main/ruoyi_elevation_of_privileges/ruoyi_elevation_of_privileges.md

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.