Description

CVE-2024-9048 is a cross-site scripting (XSS) vulnerability in y_project RuoYi up to version 4.7.9. The vulnerability allows an attacker to inject malicious scripts into the application, which can be used to steal user credentials, session cookies, or other sensitive information. The SVRS for this vulnerability is 37, indicating a moderate level of risk.

Key Insights

• The vulnerability is located in the SysUserServiceImpl function of the ruoyi-system component.
• The vulnerability can be exploited remotely with a high level of complexity.
• The exploit has been publicly disclosed and may be used by attackers.

Mitigation Strategies

• Apply the patch provided by the vendor (9b68013b2af87b9c809c4637299abd929bc73510).
• Implement input validation to prevent malicious scripts from being injected into the application.
• Use a web application firewall (WAF) to block malicious requests.

Additional Information

• Threat Actors/APT Groups: No specific threat actors or APT groups have been identified as actively exploiting this vulnerability.
• Exploit Status: Active exploits have been published.
• CISA Warnings: The Cybersecurity and Infrastructure Security Agency (CISA) has not issued a warning for this vulnerability.
• In the Wild: There is no evidence that this vulnerability is being actively exploited in the wild.

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.