Critical severity · published Aug 21, 2023
CVE-2023-4450
A vulnerability was found in jeecgboot JimuReport up to 1.6.0
9.8
CVSS
11.6%
EPSS
No
On KEV
Description
A vulnerability was found in jeecgboot JimuReport up to 1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Template Handler. The manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.6.1 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-237571.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)11.6% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JI
Jimureport · Jeecg
before 1.6.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-4450
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-4450
Broken Link
https://github.com/keecth/bug/blob/main/jimureport%20ssti(RCE).md
Permissions Required
https://vuldb.com/?ctiid.237571
VDB Entry
https://vuldb.com/?id.237571
More from Jimureport
9.8
CVE-2025-66913
JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs
9.8
CVE-2025-10771
jeecgboot JimuReport DB2 JDBC testConnection deserialization
9.8
CVE-2025-8963
jeecgboot JimuReport Data Large Screen Template testConnection deserialization
9.8
CVE-2024-44893
An issue in the component /jeecg-boot/jmreport/dict/list of JimuReport v1.7.8 allows attacker to escalate privileges via a crafted GET request
9.8
CVE-2023-6307
A vulnerability classified as critical was found in jeecgboot JimuReport up to 1.6.1