RuoYi Vulnerability: Cross-Site Scripting Attack via HttpHeaders.CONTENT_TYPE
CVE-2024-6511

6.1MEDIUM

Key Information:

Vendor

y_project

Status
Ruoyi
Vendor
CVE Published:
4 July 2024

What is CVE-2024-6511?

A vulnerability classified as problematic was found in y_project RuoYi up to 4.7.9. Affected by this vulnerability is the function isJsonRequest of the component Content-Type Handler. The manipulation of the argument HttpHeaders.CONTENT_TYPE leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270343.

References

https://vuldb.com/?id.270343
https://vuldb.com/?ctiid.270343
https://gitee.com/y_project/RuoYi/issues/IA8O7O

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.