CVE-2024-40489

EUVD-2024-55519
There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows attackers to execute arbitrary code on components through specially crafted HTTP requests.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 78%
Affected Products (NVD)
VendorProductVersion
jeecgjeecg_boot
3.0 ≤
𝑥
≤ 3.5.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://gist.github.com/aqyoung/2fd6329ceb06b731a621356921f0d5f0
https://pan.baidu.com/s/14WOPXhRHoxr4FRKGme59ug?pwd=sktp