Insecure Role Assignment in RuoYi v4.8.0 by Yangzongzhuan
CVE-2024-57438

5.4MEDIUM

Key Information:

Vendor

yangzongzhuan

Status
RuoYi
Vendor
CVE Published:
29 January 2025

What is CVE-2024-57438?

In RuoYi version 4.8.0, a security flaw related to insecure permissions enables authenticated users to escalate their privileges by assigning themselves roles that grant higher access levels. This vulnerability poses a significant risk, allowing unauthorized access to sensitive functionalities that should be restricted to higher-level users. It underscores the importance of implementing strict permission checks to mitigate the risk of unauthorized privilege escalation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://github.com/yangzongzhuan/RuoYi
https://gitee.com/y_project/RuoYi
https://ruoyi.vip/

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.