CVE-2025-4537

Katalog CVE

CVSS 3.1 · Low EPSS 0,31%

Kerentanan Cleartext Storage of Sensitive Information pada ruoyi-vue. Skor CVSS 3.1 3.1 (Low) menurut vuldb.com.

Deskripsi (NVD)

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic. Affected by this issue is some unknown functionality of the file ruoyi-ui/jsencrypt.js and ruoyi-ui/login.vue of the component Password Handler. The manipulation leads to cleartext storage of sensitive information in a cookie. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.

Rincian

Terbit di NVD

11 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.1 (Low), sumber vuldb.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-312: Cleartext Storage of Sensitive Information
CWE-315: Cleartext Storage of Sensitive Information in a Cookie

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 22,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/?id.308282 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.566469 advisory pihak ketiga · vdb entry
• https://magnificent-dill-351.notion.site/Password-Disclosure-in-RuoYi-Vue-3-8-9-1e3c693918ed80ee9799f270c8346c... broken link
• https://vuldb.com/?ctiid.308282 permissions required · vdb entry