CVE-2025-4537: yangzongzhuan RuoYi-Vue Password login.vue sensitive information in a cookie
A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic. Affected by this issue is some unknown functionality of the file ruoyi-ui/jsencrypt.js and ruoyi-ui/login.vue of the component Password Handler. The manipulation leads to cleartext storage of sensitive information in a cookie. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4537?
CVE-2025-4537 is classified as a problematic vulnerability affecting versions of RuoYi-Vue up to 3.8.9.
What functionality is affected by CVE-2025-4537?
CVE-2025-4537 affects the file ruoyi-ui/jsencrypt.js and ruoyi-ui/login.vue within the Password Handler component.
What is the impact of CVE-2025-4537?
The manipulation allowed by CVE-2025-4537 leads to cleartext storage of sensitive information.
How do I fix CVE-2025-4537?
To remediate CVE-2025-4537, update RuoYi-Vue to the latest version that addresses this vulnerability.
What are the versions of RuoYi-Vue affected by CVE-2025-4537?
CVE-2025-4537 affects RuoYi-Vue versions up to and including 3.8.9.