CVE-2025-10977: JeecgBoot deleteBatch improper authorization
A vulnerability was identified in JeecgBoot up to 3.8.2. Impacted is an unknown function of the file /sys/tenant/deleteBatch. The manipulation of the argument ids leads to improper authorization. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10977?
CVE-2025-10977 is considered a high-severity vulnerability due to its potential for remote exploitation and improper authorization.
How do I fix CVE-2025-10977?
To fix CVE-2025-10977, update JeecgBoot to version 3.8.3 or later to ensure proper authorization handling.
What affected versions are there for CVE-2025-10977?
CVE-2025-10977 affects JeecgBoot versions up to and including 3.8.2.
What type of attack is possible with CVE-2025-10977?
CVE-2025-10977 allows for remote attacks that exploit improper authorization in the deletion functionality.
Where is the vulnerability located in the software for CVE-2025-10977?
CVE-2025-10977 is located in the /sys/tenant/deleteBatch function of JeecgBoot.