CVE-2025-4819 – Y_Project RuoYi Remote Improper Authorization Vulnerability

The following table lists the changes that have been made to the
CVE-2025-4819 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution
of a vulnerability, and for identifying the most recent changes that may
impact the vulnerability’s severity, exploitability, or other characteristics.

  • New CVE Received
    by [email protected]

    May. 17, 2025

    Action Type Old Value New Value
    Added Description A vulnerability classified as problematic has been found in y_project RuoYi 4.8.0. Affected is an unknown function of the file /monitor/online/batchForceLogout of the component Offline Logout. The manipulation of the argument ids leads to improper authorization. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.
    Added CVSS V4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
    Added CVSS V3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
    Added CVSS V2 (AV:N/AC:H/Au:S/C:N/I:N/A:P)
    Added CWE CWE-285
    Added CWE CWE-266
    Added Reference https://github.com/chujianxin0101/vuln/issues/4
    Added Reference https://vuldb.com/?ctiid.309276
    Added Reference https://vuldb.com/?id.309276
    Added Reference https://vuldb.com/?submit.574443
Share the Post:

Related Posts