CNNVD-202509-1784 Information
CNNVD ID
CNNVD-202509-1784
Related CVE
- CNNVD Published: 2025-09-12
Description (Chinese)
JeecgBoot是中国国炬（Jeecg）公司的一个适用于企业 Web 应用程序的 Java 低代码平台。 JeecgBoot 3.8.2及之前版本存在授权问题漏洞，该漏洞源于WebSocket Message Handler组件中文件/api/system/sendWebSocketMsg对参数userIds授权不当，可能导致远程攻击。
Description (English)
JeecgBoot is a Java low-code platform for the enterprise Web application of Jeecg. JeecgBoot 3.8.2 and previous versions had a mandate gap, which stemmed from the inappropriate authorization of userIds for the parameters in the documents/api/system/sendWebSocketMsg in the WebSocket Message Handler component, which could lead to a remote attack.
Hazard Level
High
Vulnerability Type
授权问题
Affected Vendor
Jehovahs Witnesses
Published
2025-09-12
Last Modified
2026-02-24
References
https://vuldb.com/?ctiid.323742 https://vuldb.com/?id.323742 https://vuldb.com/?submit.643391 https://www.cnblogs.com/aibot/p/19063341 https://access.redhat.com/security/cve/cve-2025-10318
Share on: