CVE-2024-57436

Description

RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie.

Risk Information

Base Score

7.2

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.239

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2024-57436,CVE-2024-57439,CVE-2024-57438 are affected in RuoYi-ruoyi 4.8.0	Windows
Vulnerabilities CVE-2024-57436,CVE-2024-57439,CVE-2024-57438 are affected in RuoYi-ruoyi for Linux 4.8.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234