7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2024-57436

GHSA ID

GHSA-v664-qgx9-wf79

EPSS Score

0.28504%

CWE

CWE-200

Published

1/29/2025

Updated

1/29/2025

KEV Status

Technology

Java

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-57436

CVE-2024-57436: RuoYi allowed unauthorized attackers to view the session ID of the admin in the system monitoring

RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-57436

CVE-2024-57436:

7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2024-57436

GHSA ID

GHSA-v664-qgx9-wf79

EPSS Score

0.28504%

CWE

CWE-200

Published

1/29/2025

Updated

1/29/2025

KEV Status

Technology

Java

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.ruoyi:ruoyi	maven	<= 4.8.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability centers on unauthorized session ID exposure in system monitoring. Analysis of RuoYi's architecture indicates:

Session management is typically handled through Shiro integration
The system monitoring feature would require access to session data
The GHSA description confirms session IDs are visible in monitoring
Common patterns in Spring Boot applications show session listing functionality in monitor controllers While exact implementation details aren't available, the combination of Shiro session management, monitoring endpoints, and the described vulnerability pattern strongly suggests insecure session data exposure in these components.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7.2

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2024-57436: RuoYi allowed unauthorized attackers to view the session ID of the admin in the system monitoring

CVE-2024-57436:

7.2

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Technical Details

Basic Information

Basic Information

CVE-2024-57436: RuoYi allowed unauthorized attackers to view the session ID of the admin in the system monitoring

7.2

7.2

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI