PT-2025-53635 · Unknown · Jeecg-Boot

Huangweigang · Published 2025-12-28 · Updated 2025-12-28 · CVE-2025-15120

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions JeecgBoot versions up to 3.9.0

Description A flaw exists in JeecgBoot that relates to improper authorization. The issue is present in the getDeptRoleList function located in the /sys/sysDepartRole/getDeptRoleList file. Manipulation of the departId argument can lead to this authorization problem. The attack can be carried out remotely, but requires a high degree of complexity and is considered difficult to exploit. The exploit for this issue has been published.

Recommendations JeecgBoot versions prior to 3.9.0 should be updated.

Exploit

Fix

Incorrect Authorization

Incorrect Privilege Assignment

Improper Authorization

Weakness Enumeration

CWE-863

CWE-266

CWE-285

Related Identifiers

CVE-2025-15120

Affected Products

Jeecg-Boot

References · 9

• 🔥 https://github.com/Hwwg/cve/issues/33 · Exploit
• 🔥 https://vuldb.com/?submit.711772 · Exploit
• https://osv.dev/vulnerability/CVE-2025-15120 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15120 · Security Note
• https://vuldb.com/?ctiid.338498 · Note
• https://t.me/CVEtracker/40756 · Telegram Post
• https://t.me/cveNotify/146958 · Telegram Post
• https://twitter.com/CVEnew/status/2005134470525886563 · Twitter Post
• https://vuldb.com/?id.338498 · Note