CVE-2025-4819

A vulnerability classified as problematic has been found in y_project RuoYi 4.8.0. Affected is an unknown function of the file /monitor/online/batchForceLogout of the component Offline Logout. The manipulation of the argument ids leads to improper authorization. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.

CVSS v3 3.1 LOW
CVSS v2.0 2.1 LOW

3.1^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:S/C:N/I:N/A:P

Exploitability : 3.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://github.com/chujianxin0101/vuln/issues/4	Exploit Issue Tracking Third Party Advisory
https://vuldb.com/?ctiid.309276	Permissions Required VDB Entry
https://vuldb.com/?id.309276	Third Party Advisory VDB Entry
https://vuldb.com/?submit.574443	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:ruoyi:ruoyi:4.8.0:*:*:*:*:*:*:*

History

10 Oct 2025, 18:01

Type	Values Removed	Values Added
CPE		cpe:2.3:a:ruoyi:ruoyi:4.8.0:::::::*
First Time		Ruoyi Ruoyi ruoyi
References	~~() https://github.com/chujianxin0101/vuln/issues/4 -~~	() https://github.com/chujianxin0101/vuln/issues/4 - Exploit, Issue Tracking, Third Party Advisory
References	~~() https://vuldb.com/?ctiid.309276 -~~	() https://vuldb.com/?ctiid.309276 - Permissions Required, VDB Entry
References	~~() https://vuldb.com/?id.309276 -~~	() https://vuldb.com/?id.309276 - Third Party Advisory, VDB Entry
References	~~() https://vuldb.com/?submit.574443 -~~	() https://vuldb.com/?submit.574443 - Third Party Advisory, VDB Entry

19 May 2025, 13:35

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-17 06:15

Updated : 2025-10-10 18:01

NVD link : CVE-2025-4819

Mitre link : CVE-2025-4819

CVE.ORG link : CVE-2025-4819

JSON object : View

Products Affected

ruoyi

ruoyi

CWE

CWE-266

Incorrect Privilege Assignment

CWE-285

Improper Authorization

{"id": "CVE-2025-4819", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:S/C:N/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "HIGH", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-05-17T06:15:19.287", "references": [{"url": "https://github.com/chujianxin0101/vuln/issues/4", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?ctiid.309276", "tags": ["Permissions Required", "VDB Entry"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?id.309276", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?submit.574443", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cna@vuldb.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-266"}, {"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability classified as problematic has been found in y_project RuoYi 4.8.0. Affected is an unknown function of the file /monitor/online/batchForceLogout of the component Offline Logout. The manipulation of the argument ids leads to improper authorization. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad clasificada como problem\u00e1tica en y_project RuoYi 4.8.0. La vulnerabilidad afecta a una funci\u00f3n desconocida del archivo /monitor/online/batchForceLogout del componente Offline Logout. La manipulaci\u00f3n de los identificadores de los argumentos provoca una autorizaci\u00f3n incorrecta. Es posible ejecutar el ataque de forma remota. La complejidad del ataque es bastante alta. Se considera que su explotaci\u00f3n es dif\u00edcil. Se ha hecho p\u00fablico el exploit y puede que sea utilizado."}], "lastModified": "2025-10-10T18:01:20.967", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ruoyi:ruoyi:4.8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1248589F-5F63-4535-B2C9-EBBA85EA6D83"}], "operator": "OR"}]}], "sourceIdentifier": "cna@vuldb.com"}