CVE-2025-67342: XSS
RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. While the endpoint is protected by an XSS filter, the protection can be bypassed. Additionally, because the menu is shared across all users, any user with menu modification permissions can impact all users by exploiting this stored XSS vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67342?
CVE-2025-67342 is classified as a moderate severity vulnerability due to the potential for stored cross-site scripting attacks.
How do I fix CVE-2025-67342?
To fix CVE-2025-67342, update RuoYi to version 4.8.2 or later, which includes patches for the stored XSS vulnerability.
What versions are affected by CVE-2025-67342?
RuoYi versions 4.8.1 and earlier are affected by CVE-2025-67342.
What is the impact of CVE-2025-67342 on users?
The impact of CVE-2025-67342 allows attackers to execute arbitrary scripts in the context of users with menu modification permissions.
Is there an exploit available for CVE-2025-67342?
Yes, an exploit for CVE-2025-67342 may be crafted by utilizing the stored XSS vulnerability in the affected endpoint.