CVE-2025-4537: yangzongzhuan RuoYi-Vue Password login.vue sensitive information in a cookie
First published: Sun May 11 2025(Updated: )
A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic. Affected by this issue is some unknown functionality of the file ruoyi-ui/jsencrypt.js and ruoyi-ui/login.vue of the component Password Handler. The manipulation leads to cleartext storage of sensitive information in a cookie. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
Credit: cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| RuoYi-Vue | <=3.8.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-4537?
CVE-2025-4537 is classified as a problematic vulnerability affecting versions of RuoYi-Vue up to 3.8.9.
What functionality is affected by CVE-2025-4537?
CVE-2025-4537 affects the file ruoyi-ui/jsencrypt.js and ruoyi-ui/login.vue within the Password Handler component.
What is the impact of CVE-2025-4537?
The manipulation allowed by CVE-2025-4537 leads to cleartext storage of sensitive information.
How do I fix CVE-2025-4537?
To remediate CVE-2025-4537, update RuoYi-Vue to the latest version that addresses this vulnerability.
What are the versions of RuoYi-Vue affected by CVE-2025-4537?
CVE-2025-4537 affects RuoYi-Vue versions up to and including 3.8.9.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/type
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/title
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/severity
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/yangzongzhuan
- canonical/ruoyi-vue