anji-plus AJ-Report is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to HTTP requests to bypass authentication and execute arbitrary Java on the victim server.
References
| Link | Resource |
|---|---|
| https://vulncheck.com/advisories/aj-report-swagger | Third Party Advisory |
| https://gitee.com/anji-plus/report/pulls/166/files | Patch |
| https://xz.aliyun.com/t/14460 | Exploit Third Party Advisory |
| https://github.com/yuebusao/AJ-REPORT-EXPLOIT | Exploit |
| https://github.com/vulhub/vulhub/tree/master/aj-report/CNVD-2024-15077 | Exploit Third Party Advisory |
Configurations
History
17 Sep 2024, 15:45
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:anji-plus:report:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| References | () https://xz.aliyun.com/t/14460 - Exploit, Third Party Advisory | |
| References | () https://github.com/yuebusao/AJ-REPORT-EXPLOIT - Exploit | |
| References | () https://github.com/vulhub/vulhub/tree/master/aj-report/CNVD-2024-15077 - Exploit, Third Party Advisory | |
| References | () https://vulncheck.com/advisories/aj-report-swagger - Third Party Advisory | |
| References | () https://gitee.com/anji-plus/report/pulls/166/files - Patch | |
| CWE | NVD-CWE-Other | |
| First Time |
Anji-plus report
Anji-plus |
02 Aug 2024, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-08-02 17:16
Updated : 2024-09-17 15:45
NVD link : CVE-2024-7314
Mitre link : CVE-2024-7314
JSON object : View
Products Affected
anji-plus
- report
CWE