What is GHSA-v664-qgx9-wf79?

GHSA-v664-qgx9-wf79 is a security advisory published by GitHub Security Advisories with High severity. RuoYi allowed unauthorized attackers to view the session ID of the admin in the system monitoring

Which CVE IDs does GHSA-v664-qgx9-wf79 cover?

GHSA-v664-qgx9-wf79 covers the following CVE IDs: CVE-2024-57436. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v664-qgx9-wf79?

GHSA-v664-qgx9-wf79 has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

Which products are affected by GHSA-v664-qgx9-wf79?

GHSA-v664-qgx9-wf79 affects 1 product, including: maven/com.ruoyi:ruoyi:\u003c= 4.8.0.

GHSA-v664-qgx9-wf79HighCVSS 7.2

RuoYi allowed unauthorized attackers to view the session ID of the admin in the system monitoring

Vendor

GitHub Security Advisories

Published

January 29, 2025

Last Modified

January 29, 2025

🔗 CVE IDs covered (1)

CVE-2024-57436 →

📋 Description

RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie.

🎯 Affected products1

maven/com.ruoyi:ruoyi:<= 4.8.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2024-57436
https://github.com/peccc/restful_vul/blob/main/ruoyi_elevation_of_privileges/ruoyi_elevation_of_privileges.md
https://github.com/yangzongzhuan/RuoYi
https://ruoyi.vip
https://github.com/advisories/GHSA-v664-qgx9-wf79