CVE-2025-10318: JeecgBoot WebSocket Message sendWebSocketMsg improper authorization
A vulnerability was identified in JeecgBoot up to 3.8.2. Affected by this vulnerability is an unknown functionality of the file /api/system/sendWebSocketMsg of the component WebSocket Message Handler. The manipulation of the argument userIds leads to improper authorization. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10318?
CVE-2025-10318 has a severity rating that indicates it poses a risk of improper authorization.
How do I fix CVE-2025-10318?
To fix CVE-2025-10318, upgrade JeecgBoot to version 3.8.3 or later.
What component is affected by CVE-2025-10318?
CVE-2025-10318 affects the WebSocket Message Handler component in JeecgBoot.
What versions of JeecgBoot are vulnerable to CVE-2025-10318?
Versions of JeecgBoot up to and including 3.8.2 are vulnerable to CVE-2025-10318.
How can CVE-2025-10318 be exploited?
CVE-2025-10318 can be exploited by manipulating the userIds argument, leading to improper authorization.