Deserialization Vulnerability in anji-plus AJ-Report Product
CVE-2024-5351

9.8CRITICAL

Key Information:

Vendor

anji-plus

Status
Aj-report
Vendor
CVE Published:
26 May 2024

What is CVE-2024-5351?

A serious vulnerability exists in the anji-plus AJ-Report software, specifically affecting versions up to 1.4.1. The vulnerability is rooted in the 'getValueFromJs' function within the Javascript Handler component, which is susceptible to deserialization attacks. This allows attackers to craft malicious payloads that can be processed by the application, leading to unauthorized access and manipulation of data. The exploit can be executed remotely, making it particularly dangerous for environments using this product. As the details of this vulnerability have been publicly disclosed, immediate action is essential to safeguard systems utilizing AJ-Report.

References

https://vuldb.com/?id.266263
https://vuldb.com/?ctiid.266263
https://github.com/anji-plus/report/issues/34

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.