CVE-2024-7314
anji-plus AJ-Report Authentication Bypass
Severity Score
9.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
3
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Attend
*SSVC
Descriptions
anji-plus AJ-Report is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to HTTP requests to bypass authentication and execute arbitrary Java on the victim server.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Attend
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-07-30 CVE Reserved
- 2024-08-02 CVE Published
- 2024-08-07 CVE Updated
- 2024-08-07 First Exploit
- 2024-09-18 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-280: Improper Handling of Insufficient Permissions or Privileges
CAPEC
- CAPEC-115: Authentication Bypass
References (5)
| URL | Tag | Source |
|---|---|---|
| https://vulncheck.com/advisories/aj-report-swagger | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://github.com/vulhub/vulhub/tree/master/aj-report/CNVD-2024-15077 | 2024-08-07 | |
| https://github.com/yuebusao/AJ-REPORT-EXPLOIT | 2024-08-07 | |
| https://xz.aliyun.com/t/14460 | 2024-08-07 |
| URL | Date | SRC |
|---|---|---|
| https://gitee.com/anji-plus/report/pulls/166/files | 2024-08-02 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Anji-plus Search vendor "Anji-plus" | AJ-Report Search vendor "Anji-plus" for product "AJ-Report" | < 1.4.1 Search vendor "Anji-plus" for product "AJ-Report" and version " < 1.4.1" | en |
Affected
| ||||||