PT-2025-3443 · Ruoyi · Ruoyi

Published 2025-01-29 · Updated 2025-05-14 · CVE-2024-57436

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RuoYi version 4.8.0

Description The issue allows unauthorized attackers to view the session ID of the admin in the system monitoring, enabling them to impersonate Admin users via a crafted cookie.

Recommendations RuoYi version 4.8.0: Update the system to prevent session ID exposure and ensure proper cookie handling to mitigate admin impersonation risks.

Exploit

Fix

Information Disclosure

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-200

CWE-922

Related Identifiers

CVE-2024-57436

GHSA-V664-QGX9-WF79

Affected Products

Ruoyi

References · 10

• 🔥 https://github.com/peccc/restful_vul/blob/main/ruoyi_elevation_of_privileges/ruoyi_elevation_of_privileges.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-57436 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v664-qgx9-wf79 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-57436 · Security Note
• https://github.com/yangzongzhuan/RuoYi · Note
• https://t.me/cvenotify/122189 · Telegram Post
• https://t.me/cvedetector/16685 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1884635902477029459 · Twitter Post
• https://ruoyi.vip · Note
• https://gitee.com/y_project/RuoYi · Note