PT-2025-3445 · Ruoyi · Ruoyi

Published 2025-01-29 · Updated 2025-05-14 · CVE-2024-57438

Positive Technologies (AI Summary)

CVSS v4.0

5.6

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions RuoYi version 4.8.0

Description The issue concerns insecure permissions that allow authenticated attackers to escalate privileges by assigning themselves higher level roles.

Recommendations For RuoYi version 4.8.0, update the permissions to restrict role assignments and prevent privilege escalation. Ensure that only authorized users can assign roles to prevent abuse.

Exploit

Fix

Incorrect Authorization

Incorrect Default Permissions

Weakness Enumeration

CWE-863

CWE-276

Related Identifiers

CVE-2024-57438

GHSA-H5JH-RP76-Q242

Affected Products

Ruoyi

References · 10

• 🔥 https://github.com/peccc/restful_vul/blob/main/ruoyi_insecure_role_assignments/ruoyi_insecure_role_assignments.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-57438 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h5jh-rp76-q242 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-57438 · Security Note
• https://github.com/yangzongzhuan/RuoYi · Note
• https://t.me/cvenotify/122191 · Telegram Post
• https://gitee.com/y_project/RuoYi · Note
• https://ruoyi.vip · Note
• https://twitter.com/WolfgangSesin/status/1884626547253866890 · Twitter Post
• https://t.me/cvedetector/16687 · Telegram Post