CVE-2023-1784: jeecg-boot-parent - Improper Authentication
Summary
CVE-2023-1784: jeecg-boot vulnerable to improper authentication. Affects org.jeecgframework.boot:jeecg-boot-parent versions < 3.5.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jeecg-boot-parent is a Maven package that provides functionality for the jeecg-boot framework. jeecg-boot is an open-source rapid development platform for building enterprise-level web applications. It offers features such as code generation, visual configuration, and a flexible plugin mechanism. The package is widely used in various industries for developing web applications.
Vulnerability Detail
The vulnerability (CVE-2023-1784) affects jeecg-boot version 3.5.0. It is related to the improper authentication process in the component API Documentation. The software fails to adequately verify the correctness of identity claims made by actors, leading to a vulnerability in the authentication mechanism. This vulnerability can be exploited remotely, and the details of the exploit have been publicly disclosed. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-287.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
At present, there is no known workaround for this vulnerability. It is strongly advised to apply the recommended fix by upgrading to a patched version of jeecg-boot-parent.
Conclusion
In conclusion, the jeecg-boot-parent package is vulnerable to an improper authentication issue in the component API Documentation. This vulnerability can be exploited remotely and may lead to unauthorized access. It is crucial to upgrade to a patched version of jeecg-boot-parent to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.jeecgframework.boot:jeecg-boot-parent →
FAQ
jeecg-boot-parent is a Maven package that provides functionality for the jeecg-boot framework. It is used for rapid development of enterprise-level web applications.
The vulnerability allows for improper authentication, which can lead to unauthorized access and potential security breaches in applications built using jeecg-boot.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
Yes, a fix is available for this vulnerability. It is recommended to upgrade jeecg-boot-parent to a version that includes the necessary security patches.
For more information about this vulnerability, you can refer to the GitHub Security Advisory database (https://github.com/github/advisory-database) and search for the advisory with the identifier GHSA-6rfv-h5v8-cj7g.
Related vulnerabilities
Recent vulnerabilities recorded for org.jeecgframework.boot:jeecg-boot-parent.
