CVE-2024-5352 - anji-plus AJ-Report validationRules deserialization

Back Back to CVE browser

MEDIUM

anji-plus AJ-Report validationRules deserialization

Published May 26, 2024

5.3

MEDIUM

CVSS 4.0

EPSS 0.77%

Description

A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been rated as critical. Affected by this issue is the function validationRules of the component com.anjiplus.template.gaea.business.modules.datasetparam.controller.DataSetParamController#verification. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-266264.

Affected products

Vendor Anji-Plus Product AJ-Report Default
n/a
- Version
  1.4.0
  Status
  affected
  Constraints
  -
- Version
  1.4.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Anji-Plus

AJ-Report

n/a

Version	Status	Constraints
1.4.0	affected	-
1.4.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (4)

https://github.com/anji-plus/report/files/15363269/aj-report.pdf
exploit
https://github.com/anji-plus/report/issues/34
issue-trackingBroken Link
https://vuldb.com/?ctiid.266264
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.266264
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://github.com/anji-plus/report/files/15363269/aj-report.pdf		exploit
https://github.com/anji-plus/report/issues/34		issue-trackingBroken Link
https://vuldb.com/?ctiid.266264		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.266264		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry