PT-2025-52398 · Unknown · Jeecg-Boot

Aibot88 · Published 2025-12-19 · Updated 2025-12-30 · CVE-2025-14908

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions JeecgBoot versions up to 3.9.0

Description A security flaw exists in JeecgBoot that allows for improper authentication. The issue is related to the manipulation of the ID argument within an unknown function in the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysTenantController.java, specifically within the Multi-Tenant Management Module. This flaw can be exploited remotely. The exploit has been publicly released.

Recommendations Apply the patch e1c8f00bf2a2e0edddbaa8119afe1dc92d9dc1d2/67795493bdc579e489d3ab12e52a1793c4f8a0ee to resolve this issue.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-14908

Affected Products

Jeecg-Boot

References · 11

• 🔥 https://github.com/jeecgboot/JeecgBoot/issues/9196 · Exploit
• 🔥 https://vuldb.com/?submit.715742 · Exploit
• https://github.com/jeecgboot/JeecgBoot/commit/e1c8f00bf2a2e0edddbaa8119afe1dc92d9dc1d2 · Patch
• https://osv.dev/vulnerability/CVE-2025-14908 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14908 · Security Note
• https://t.me/CVEtracker/40224 · Telegram Post
• https://t.me/cveNotify/146281 · Telegram Post
• https://vuldb.com/?ctiid.337432 · Note
• https://vuldb.com/?id.337432 · Note
• https://t.me/cveNotify/147203 · Telegram Post
• https://twitter.com/CVEnew/status/2002099200289579513 · Twitter Post