CVE-2024-6511

Summary

A vulnerability classified as problematic was found in y_project RuoYi up to 4.7.9. Affected by this vulnerability is the function isJsonRequest of the component Content-Type Handler. The manipulation of the argument HttpHeaders.CONTENT_TYPE leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270343.

Affected Software

VendorProductVersion RangeStatus
y_projectRuoYi4.7.0affected
y_projectRuoYi4.7.1affected
y_projectRuoYi4.7.2affected
y_projectRuoYi4.7.3affected
y_projectRuoYi4.7.4affected
y_projectRuoYi4.7.5affected
y_projectRuoYi4.7.6affected
y_projectRuoYi4.7.7affected
y_projectRuoYi4.7.8affected
y_projectRuoYi4.7.9affected

Weaknesses

  • CWE-79: CWE-79 Cross Site Scripting

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References