CVE-2023-7133: y_project RuoYi HTTP POST Request login cross site scripting

Published Dec 28, 2023

Updated

A vulnerability was found in yproject RuoYi 4.7.8. It has been declared as problematic. This vulnerability affects unknown code of the file /login of the component HTTP POST Request Handler. The manipulation of the argument rememberMe with the input falsen3f0m<script>alert(1)</script>p86o0 leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249136.

Affected Software

1 affected component

Ruoyi Ruoyi=4.7.8

Event History

Dec 28, 2023

CVE Published

05:31 PM

Data Sourced

05:31 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-7133?

CVE-2023-7133 has been declared as problematic but specific severity metrics are not provided.

How do I fix CVE-2023-7133?

To fix CVE-2023-7133, it is recommended to update to a later version of the RuoYi platform that addresses this vulnerability.

What component is affected by CVE-2023-7133?

CVE-2023-7133 affects the HTTP POST Request Handler component in the RuoYi platform.

What input parameter is exploited in CVE-2023-7133?

The input parameter exploited in CVE-2023-7133 is 'rememberMe'.

Which version of RuoYi is vulnerable to CVE-2023-7133?

Version 4.7.8 of the RuoYi platform is vulnerable to CVE-2023-7133.