CVE-2024-9048

y_project RuoYi Backend User Import SysUserServiceImpl.java SysUserServiceImpl cross site scripting

State: Published
Severity: 6.3 Medium
Published: Sep 21, 2024
Updated: Sep 23, 2024
Reserved: Sep 20, 2024

Description

A vulnerability was found in y_project RuoYi up to 4.7.9. It has been declared as problematic. Affected by this vulnerability is the function SysUserServiceImpl of the file ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysUserServiceImpl.java of the component Backend User Import. The manipulation of the argument loginName leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The patch is named 9b68013b2af87b9c809c4637299abd929bc73510. It is recommended to apply a patch to fix this issue.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	VulDB
3.1	3.1 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N	VulDB
3.0	3.1 Low	CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N	VulDB
2.0	2.6 Low	AV:N/AC:H/Au:N/C:N/I:P/A:N	VulDB

Weaknesses

CWE-79 Cross Site Scripting

Affected Products

Product	Versions
RuoYiy_project	4.7.0Affected 4.7.1Affected 4.7.2Affected 4.7.3Affected 4.7.4Affected 4.7.5Affected 4.7.6Affected 4.7.7Affected 4.7.8Affected 4.7.9Affected

References

VDB-278215 | y_project RuoYi Backend User Import SysUserServiceImpl.java SysUserServiceImpl cross site scriptingvdb-entrytechnical-description
VDB-278215 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
https://gitee.com/y_project/RuoYi/issues/IAR6Q3exploitissue-tracking
https://gitee.com/y_project/RuoYi/issues/IAR6Q3#note_31993641_linkissue-tracking
https://gitee.com/y_project/RuoYi/commit/9b68013b2af87b9c809c4637299abd929bc73510patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.