{"cve":"CVE-2024-57436","nvd":{"published":"2025-01-29T15:15:17.073","modified":"2026-06-17T08:13:35.053","status":"Analyzed","description":"RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":7.2},"cwes":["CWE-922"],"references":["https://github.com/peccc/restful_vul/blob/main/ruoyi_elevation_of_privileges/ruoyi_elevation_of_privileges.md","https://github.com/yangzongzhuan/RuoYi","https://ruoyi.vip/","https://github.com/peccc/restful_vul/blob/main/ruoyi_elevation_of_privileges/ruoyi_elevation_of_privileges.md"],"products":["ruoyi:ruoyi"],"source":"nvd","synced_at":"2026-10-19T21:58:41.599736885+00:00"},"epss":{"cve":"CVE-2024-57436","score":0.00644,"percentile":0.50889,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-v664-qgx9-wf79","url":"https://osv.dev/vulnerability/GHSA-v664-qgx9-wf79","summary":"RuoYi allowed unauthorized attackers to view the session ID of the admin in the system monitoring","modified":"2025-01-29T19:27:06.089061Z","packages":[{"ecosystem":"Maven","name":"com.ruoyi:ruoyi","purl":"pkg:maven/com.ruoyi/ruoyi","ranges":["<=4.8.0"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}