PT-2025-20659 · Yangzongzhuan · Ruoyi-Vue

S0L42 · Published 2025-05-11 · Updated 2025-05-11 · CVE-2025-4537

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions RuoYi-Vue versions up to 3.8.9

Description A problem was found in the Password Handler component, affecting some unknown functionality of the files ruoyi-ui/jsencrypt.js and ruoyi-ui/login.vue. This issue leads to cleartext storage of sensitive information in a cookie. The attack can be launched remotely, and the complexity of the attack is rather high. The exploitation is known to be difficult.

Recommendations For versions up to 3.8.9, consider disabling the functionality related to the files ruoyi-ui/jsencrypt.js and ruoyi-ui/login.vue of the Password Handler component as a temporary workaround until a patch is available. Restrict access to sensitive information stored in cookies to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-315

CWE-312

Related Identifiers

CVE-2025-4537

Affected Products

Ruoyi-Vue

References · 11

• 🔥 https://magnificent-dill-351.notion.site/Password-Disclosure-in-RuoYi-Vue-3-8-9-1e3c693918ed80ee9799f270c8346cd4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-4537 · Security Note
• https://osv.dev/vulnerability/CVE-2025-4537 · Vendor Advisory
• https://vuldb.com/?id.308282 · Note
• https://vuldb.com/?submit.566469 · Note
• https://t.me/cvedetector/25043 · Telegram Post
• https://twitter.com/CVEnew/status/1921503203197173971 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1921514617974476995 · Twitter Post
• https://vuldb.com/?ctiid.308282 · Note
• https://t.me/cvenotify/121671 · Telegram Post
• https://t.me/cvetracker/23578 · Telegram Post