CVE-2021-37305: Insecure Permissions issue in jeecg-boot
Summary
CVE-2021-37305: Insecure Permissions issue in jeecg-boot. Affects org.jeecgframework.boot:jeecg-boot-base versions < 2.4.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
jeecg-boot is a Maven package that provides a framework for developing enterprise-level Java applications. It offers various features and functionalities to streamline the development process. However, versions 2.4.5 and earlier of jeecg-boot are vulnerable to an Insecure Permissions issue. This vulnerability allows remote attackers to gain escalated privileges and access sensitive information by exploiting the '/sys/user/querySysUser?username=admin' API endpoint.
Vulnerability Detail
The Insecure Permissions issue in jeecg-boot arises due to improper access control mechanisms. Attackers can exploit this vulnerability by sending a specially crafted request to the vulnerable API endpoint. By doing so, they can gain elevated privileges and view sensitive information, potentially leading to further attacks or unauthorized access to the system. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the vulnerable API endpoint by implementing proper access control rules at the network level or using a web application firewall (WAF). This can help mitigate the risk of unauthorized access until the application is updated to a secure version.
Conclusion
In summary, the Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privileges and access sensitive information. It is crucial to upgrade to a patched version (2.4.6 or later) and strengthen access control mechanisms to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jeecgframework.boot:jeecg-boot-base →
FAQ
jeecg-boot is a Maven package that provides a framework for developing enterprise-level Java applications. It offers various features and functionalities to streamline the development process.
This vulnerability allows remote attackers to gain escalated privileges and view sensitive information. It can potentially lead to further attacks or unauthorized access to the system.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
To fix this vulnerability, it is recommended to upgrade to a patched version of jeecg-boot (2.4.6 or later). Additionally, review and strengthen the access control mechanisms within the application.
As a temporary workaround, users can restrict access to the vulnerable API endpoint by implementing proper access control rules at the network level or using a web application firewall (WAF).
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jeecgframework.boot:jeecg-boot-base.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
