CVE-2025-0734 - y_project RuoYi Whitelist getBeanName deserialization

Back Back to CVE browser

MEDIUM

y_project RuoYi Whitelist getBeanName deserialization

Published Jan 27, 2025

5.1

MEDIUM

CVSS 4.0

EPSS 0.52%

Description

A vulnerability has been found in y_project RuoYi up to 4.8.0 and classified as critical. This vulnerability affects the function getBeanName of the component Whitelist. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor Y Project Product RuoYi Default
n/a
- Version
  4.0
  Status
  affected
  Constraints
  -
- Version
  4.1
  Status
  affected
  Constraints
  -
- Version
  4.2
  Status
  affected
  Constraints
  -
- Version
  4.3
  Status
  affected
  Constraints
  -
- Version
  4.4
  Status
  affected
  Constraints
  -
- Version
  4.5
  Status
  affected
  Constraints
  -
- Version
  4.6
  Status
  affected
  Constraints
  -
- Version
  4.7
  Status
  affected
  Constraints
  -
- Version
  4.8
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Y Project

RuoYi

n/a

Version	Status	Constraints
4.0	affected	-
4.1	affected	-
4.2	affected	-
4.3	affected	-
4.4	affected	-
4.5	affected	-
4.6	affected	-
4.7	affected	-
4.8	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-502

Deserialization of Untrusted Data

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-1842
Advisory
https://gist.github.com/GSBP0/3c1b0f9dbdd2a48b8f52330cfbbc279b
exploitBroken Link
https://vuldb.com/?ctiid.293512
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.293512
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.482823
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-1842		Advisory
https://gist.github.com/GSBP0/3c1b0f9dbdd2a48b8f52330cfbbc279b		exploitBroken Link
https://vuldb.com/?ctiid.293512		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.293512		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.482823		third-party-advisoryThird Party AdvisoryVDB Entry