Medium severity · published Jul 4, 2024
CVE-2024-6511
y_project RuoYi Content-Type isJsonRequest cross site scripting
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability classified as problematic was found in y_project RuoYi up to 4.7.9. Affected by this vulnerability is the function isJsonRequest of the component Content-Type Handler. The manipulation of the argument HttpHeaders.CONTENT_TYPE leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270343.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RU
RuoYi · y_project
4.7.0; 4.7.1; 4.7.2; 4.7.3; 4.7.4; 4.7.5; +4 more · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-6511
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-6511
Exploit
https://gitee.com/y_project/RuoYi/issues/IA8O7O
Permissions Required
https://vuldb.com/?ctiid.270343
Third Party Advisory
https://vuldb.com/?id.270343
More from RuoYi
9.8
CVE-2022-4566
y_project RuoYi GenController sql injection
7.5
CVE-2023-3163
y_project RuoYi filterKeyword resource consumption
7.2
CVE-2025-0734
y_project RuoYi Whitelist getBeanName deserialization
6.1
CVE-2024-9048
y_project RuoYi Backend User Import SysUserServiceImpl.java SysUserServiceImpl cross site scripting
6.1
CVE-2023-7133
y_project RuoYi HTTP POST Request login cross site scripting