Description

anji-plus AJ-Report is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to HTTP requests to bypass authentication and execute arbitrary Java on the victim server.

Related CPE's

a

anji-plus

report

Vulnerable

References

https://gitee.com/anji-plus/report/pulls/166/files

Patch

https://github.com/vulhub/vulhub/tree/master/aj-report/CNVD-2024-15077

ExploitThird Party Advisory

https://github.com/yuebusao/AJ-REPORT-EXPLOIT

Exploit

https://vulncheck.com/advisories/aj-report-swagger

Third Party Advisory

https://xz.aliyun.com/t/14460

ExploitThird Party Advisory

Weaknesses

[email protected]

Primary
NVD-CWE-Other

[email protected]

Secondary
CWE-280

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 · Critical

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2024-08-02T17:16:41.400

11 months ago

Last modified

2024-09-17T15:45:01.970

9 months ago