Vulnerability DatabaseCVE-2024-57438
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2024-57438
Published:January 29, 2025
Updated:August 06, 2026
Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles.
Related Resources (7)
https://ruoyi.vip
https://github.com/peccc/restful_vul/blob/main/ruoyi_insecure_role_assignments/ruoyi_insecure_role_assignments.md
https://nvd.nist.gov/vuln/detail/CVE-2024-57438
https://ruoyi.vip/
https://github.com/yangzongzhuan/RuoYi
https://gitee.com/y_project/RuoYi
https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/57xxx/CVE-2024-57438.json
Do you need more information?
Contact Us
CVSS v4
Base Score:
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
Exploit Maturity
POC
CVSS v3
Base Score:
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Weakness Type (CWE)
Incorrect Authorization
CWE-863
Incorrect Default Permissions
CWE-276
EPSS
Base Score:
0.33