by Kastro
Paper/Archive/CVE-2024-7314

CVE-2024-7314

anji-plus AJ-Report — anji-plus AJ-Report Authentication Bypass

EPSS 52%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.9.989 × 2019.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

anji-plus AJ-Report is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to HTTP requests to bypass authentication and execute arbitrary Java on the victim server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.

Affected

ProductAffectedFixed inSource
AJ-Report< 1.4.11.4.1CNA
report< 1.4.11.4.1CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

writeupvulncheck.com/advisories/aj-report-swaggerexploitxz.aliyun.com/t/14460exploitgithub.com/yuebusao/AJ-REPORT-EXPLOITexploitgithub.com/vulhub/vulhub/tree/master/aj-report/CNVD-2024-15077