Vulnerability Database

302,156

Total vulnerabilities in the database

CVE-2024-57436

RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie.

Published: Jan 29, 2025
Updated: Nov 16, 2025
CVE: CVE-2024-57436
GHSA: GHSA-v664-qgx9-wf79
Severity: High
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWEs:

CWE-200
CWE-922

Affected Software
References

Software	From	Fixed in
com.ruoyi / ruoyi	-	4.8.0.x
ruoyi / ruoyi	4.8.0	4.8.0.x

https://github.com/peccc/restful_vul/blob/main/ruoyi_elevation_of_privileges/ruoyi_elevation_of_privileges.md
https://github.com/yangzongzhuan/RuoYi
https://ruoyi.vip
https://ruoyi.vip/

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo