CVE-2025-0734: y_project RuoYi Whitelist getBeanName deserialization
A vulnerability has been found in yproject RuoYi up to 4.8.0 and classified as critical. This vulnerability affects the function getBeanName of the component Whitelist. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0734?
CVE-2025-0734 is classified as critical due to its potential for remote exploitation leading to deserialization.
How do I fix CVE-2025-0734?
To fix CVE-2025-0734, upgrade y_project RuoYi to a version later than 4.8.0 that addresses this vulnerability.
What systems are affected by CVE-2025-0734?
CVE-2025-0734 affects y_project RuoYi versions up to and including 4.8.0.
What type of attack is associated with CVE-2025-0734?
CVE-2025-0734 is associated with remote deserialization attacks, which can be initiated by an attacker.
What component of y_project RuoYi is vulnerable in CVE-2025-0734?
The vulnerable component in CVE-2025-0734 is the Whitelist function, specifically the getBeanName method.