CVE-2023-4450mediumexplotación observadaCWE-74

CVE-2023-4450: fallo de gravedad media en jeecgboot JimuReport

jeecgboot JimuReport Template injection

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear JimuReport

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

75Vexday Risk Score

Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.

ssvc Actcvss 6.3epss 12%
de la publicación al arma170 días
Publicada en NVD21 ago
1ª PoC+170d
VulnCheck+351d
A vulnerability was found in jeecgboot JimuReport up to 1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Template Handler. The manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.6.1 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-237571.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Productos afectados
jeecgboot · JimuReport
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — jeecgboot JimuReport

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-6307MEDIUMjeecgboot JimuReport image path traversalEPSS 0.8%CVE-2025-10771MEDIUMjeecgboot JimuReport DB2 JDBC testConnection deserializationEPSS 0.6%CVE-2025-8963MEDIUMjeecgboot JimuReport Data Large Screen Template testConnection deserializationEPSS 0.6%CVE-2025-10770MEDIUMjeecgboot JimuReport MySQL JDBC testConnection deserializationEPSS 0.4%CVE-2026-5848MEDIUMjeecgboot JimuReport Data Source testConnection DriverManager.getConnection code injectionEPSS 0.3%