CVE-2025-15125: JeecgBoot queryDepartPermission improper authorization
A security flaw has been discovered in JeecgBoot up to 3.9.0. Affected is the function queryDepartPermission of the file /sys/permission/queryDepartPermission. The manipulation of the argument departId results in improper authorization. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15125?
CVE-2025-15125 is classified as a high severity vulnerability due to improper authorization which can be exploited remotely.
How do I fix CVE-2025-15125?
To fix CVE-2025-15125, update JeecgBoot to a version later than 3.9.0 where the vulnerability has been addressed.
What systems are affected by CVE-2025-15125?
CVE-2025-15125 affects JeecgBoot versions up to and including 3.9.0.
What is the exploit method for CVE-2025-15125?
The exploit method for CVE-2025-15125 involves manipulating the departId parameter in the queryDepartPermission function.
Is remote access required to exploit CVE-2025-15125?
Yes, CVE-2025-15125 can be exploited remotely without requiring local access.