CVE-2024-7314: anji-plus AJ-Report Authentication Bypass

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 51.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-08-02 · updated 2026-06-17
Weakness: CWE-288

Description

anji-plus AJ-Report is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to HTTP requests to bypass authentication and execute arbitrary Java on the victim server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.

Affected products

anji-plus Report: before 1.4.1 — fixed in 1.4.1

How to fix

Upgrade to a fixed version: anji-plus Report 1.4.1. Check the vendor advisory for mitigations.

References

https://github.com/vulhub/vulhub/tree/master/aj-report/CNVD-2024-15077
https://github.com/yuebusao/AJ-REPORT-EXPLOIT
https://vulncheck.com/advisories/aj-report-swagger
https://xz.aliyun.com/t/14460

Get alerted when CVE-2024-7314 or the next vulnerability affects your stack