RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie.
Loading...
Loading...
Score 7.2 from GitHub Security Advisory (severity: HIGH) published 2025-01-29. NVD baseline CVSS 7.2; sources differ by 0.0.
RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie.
January 29, 2025
May 14, 2025
| Vendor / Ecosystem | Fixed in / Patch | Released | Source |
|---|---|---|---|
| maven | com.ruoyi:ruoyi | — | ghsa |
Patches are aggregated from vendor advisories (Red Hat, Microsoft, Cisco, GitHub) and package ecosystems (OSV, GHSA). Multiple rows for the same upstream release have been deduplicated.
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| com.ruoyi:ruoyi | — | — | — |
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Every time one of our enrichment pipelines (NVD, MITRE cvelistV5, EPSS, CISA KEV, GHSA, OSV, vendor advisories) ran against this CVE. Most recent first.
See which npm, PyPI, Go, and Maven packages are affected by CVE-2024-57436
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.
maven:com.ruoyi:ruoyi
CWE-200