CVE-2023-49442

critical · 9.8

Deserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows attackers to run arbitrary code via crafted POST request.

9.8

CVSS

38.5%

EPSS (exploit prob.)

99th

EPSS percentile

2024-01-03

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-502

Affected products

Vendor	Product	Affected versions
jeecg	jeecg	<= 4.0

Check a specific version with /api/v1/cve/match.

References

https://lemono.fun/thoughts/JEECG-RCE.html
https://lemono.fun/thoughts/JEECG-RCE.html

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-49442