PT-2024-39389 · Ruoyi · Ruoyi

Wang勇 · Published 2024-09-20 · Updated 2024-09-30 · CVE-2024-9048

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions RuoYi versions up to 4.7.9

Description A vulnerability was found in the function SysUserServiceImpl of the component Backend User Import. The manipulation of the argument loginName leads to cross-site scripting. The attack can be launched remotely. The complexity of an attack is rather high, and the exploitation appears to be difficult.

Recommendations For RuoYi versions up to 4.7.9, apply a patch to fix this issue, specifically the patch named 9b68013b2af87b9c809c4637299abd929bc73510. As a temporary workaround, consider validating user input for the loginName argument to minimize the risk of exploitation. Restrict access to the SysUserServiceImpl function until the patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-9048

Affected Products

Ruoyi

References · 12

• 🔥 https://gitee.com/y_project/RuoYi/issues/IAR6Q3 · Exploit
• https://osv.dev/vulnerability/CVE-2024-9048 · Vendor Advisory
• https://gitee.com/y_project/RuoYi/commit/9b68013b2af87b9c809c4637299abd929bc73510 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-9048 · Security Note
• https://t.me/cvenotify/95564 · Telegram Post
• https://twitter.com/CVEnew/status/1837411498567913771 · Twitter Post
• https://twitter.com/oktsec/status/1837169342540083324 · Twitter Post
• https://t.me/cvedetector/6139 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1837440105255960711 · Twitter Post
• https://gitee.com/y_project/RuoYi/issues/IAR6Q3#note_31993641_link · Note
• https://vuldb.com/?ctiid.278215 · Note
• https://vuldb.com/?id.278215 · Note