CVE-2024-5351: medium-severity vulnerability in anji-plus AJ-Report
anji-plus AJ-Report Javascript getValueFromJs deserialization
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.8%
A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been declared as critical. Affected by this vulnerability is the function getValueFromJs of the component Javascript Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266263.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
anji-plus · AJ-ReportRelated CVEs — anji-plus AJ-Report
In the same product, most dangerous first.
CVE-2024-7314CRITICALanji-plus AJ-Report Authentication BypassEPSS 51.7%CVE-2024-5355MEDIUManji-plus AJ-Report IGroovyHandler command injectionEPSS 3.2%CVE-2024-5356MEDIUManji-plus AJ-Report testTransform;swagger-ui sql injectionEPSS 1.0%CVE-2024-5353MEDIUManji-plus AJ-Report ZIP File decompress path traversalEPSS 0.8%CVE-2024-5352MEDIUManji-plus AJ-Report validationRules deserializationEPSS 0.8%CVE-2024-5354MEDIUManji-plus AJ-Report detailByCode information disclosureEPSS 0.6%