What’s Vulnerable › Vulnerabilities

CVE-2024-57436

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-01-29 · updated 2026-06-17
• Weakness: CWE-922

Description

RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie.

Affected products

• yangzongzhuan RuoYi: 4.8.0

References

• https://github.com/peccc/restful_vul/blob/main/ruoyi_elevation_of_privileges/ruoyi_elevation_of_privileges.md
• https://github.com/yangzongzhuan/RuoYi
• https://ruoyi.vip/
• https://github.com/peccc/restful_vul/blob/main/ruoyi_elevation_of_privileges/ruoyi_elevation_of_privileges.md

Get alerted when CVE-2024-57436 or the next vulnerability affects your stack