High severity · published Jan 27, 2025
CVE-2025-0734
y_project RuoYi Whitelist getBeanName deserialization
7.2
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability has been found in y_project RuoYi up to 4.8.0 and classified as critical. This vulnerability affects the function getBeanName of the component Whitelist. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RU
RuoYi · y_project
4.0; 4.1; 4.2; 4.3; 4.4; 4.5; +3 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0734
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0734
Broken Link
https://gist.github.com/GSBP0/3c1b0f9dbdd2a48b8f52330cfbbc279b
Permissions Required
https://vuldb.com/?ctiid.293512
Third Party Advisory
https://vuldb.com/?id.293512
Third Party Advisory
https://vuldb.com/?submit.482823
More from RuoYi
9.8
CVE-2022-4566
y_project RuoYi GenController sql injection
7.5
CVE-2023-3163
y_project RuoYi filterKeyword resource consumption
6.1
CVE-2024-9048
y_project RuoYi Backend User Import SysUserServiceImpl.java SysUserServiceImpl cross site scripting
6.1
CVE-2024-6511
y_project RuoYi Content-Type isJsonRequest cross site scripting
6.1
CVE-2023-7133
y_project RuoYi HTTP POST Request login cross site scripting