JeecgBoot versions through 3.9.5 have an insecure direct object reference (IDOR) vulnerability that allows authenticated users to access other users' AI voice generation history. By exploiting the userId parameter in the GET /airag/voice/listByUser endpoint, an attacker who knows another user's ID can retrieve sensitive data including text-to-speech inputs, voice settings, timestamps, and generated audio file metadata stored in Redis. This vulnerability has a medium severity rating with a CVSS score of 4.3.
JeecgBoot versions through 3.9.5 have an insecure direct object reference (IDOR) vulnerability that allows authenticated users to delete AI voice records belonging to other users. This occurs because the DELETE /airag/voice/deleteVoiceRecord endpoint accepts an arbitrary userId without proper authorization checks. Attackers can enumerate record IDs via the GET /airag/voice/listByUser endpoint and delete victims' text-to-speech history stored in Redis. The vulnerability has a CVSS score of 4.3, indicating medium severity.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the AigcWordTemplateController edit handler. This flaw allows any authenticated user, including those with low privileges, to modify shared word templates by sending PUT or POST requests to the /airag/word/edit endpoint. The vulnerability could lead to unauthorized modification of templates used by other users to generate documents.
JeecgBoot versions up to 3.9.5 have a missing authorization vulnerability in the AiOcrController updateById handler. This flaw allows any authenticated user, including low-privileged attackers, to modify global OCR templates by sending PUT requests to /airag/ocr/edit. Exploitation can corrupt OCR results for all users by overwriting shared Redis keys.
JeecgBoot versions up to 3.9.5 have a missing authorization vulnerability in the AiOcrController deleteById handler. This flaw allows any authenticated user, including low-privileged attackers, to delete OCR records. Attackers can enumerate record IDs via an unprotected GET endpoint and delete shared OCR prompt records stored in Redis.
JeecgBoot versions through 3.9.2 have a broken access control vulnerability allowing authenticated low-privilege users to fully manage OpenAPI credentials via endpoints lacking proper authorization. This enables attackers to list, add, edit, and delete all API key pairs, with secret keys exposed in plaintext, risking credential theft and unauthorized API access.
An open redirect vulnerability exists in JeecgBoot versions 3.9.0 through 3.9.2 in the Third-Party Login component. The issue arises from improper handling of the argument to HttpServletResponse.sendRedirect in the ThirdLoginController.java file. Exploitation requires user interaction via social engineering to click a malicious OAuth login link. The vulnerability has low exploitability and a low CVSS score of 2.3. The third-party login feature is optional and may not be enabled in many deployments.
A vulnerability was identified in JeecgBoot up to 3.9.2. Affected by this vulnerability is the function queryPageList of the file src\main\java\org\jeecg\modules\system\controller\SysUserController.java of the component User List Endpoint. The manipulation of the argument salt leads to information disclosure. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is publicly available and might be used. A fix is planned for the upcoming release.
A security flaw has been discovered in jeecgboot The server processes these URLs up to 3.9.1. This affects the function FileDownloadUtils.download2DiskFromNet of the file /airag/app/debug of the component Cloud Instance Metadata Endpoint. The manipulation results in server-side request forgery. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.9.2 mitigates this issue. It is suggested to upgrade the affected component.
A vulnerability has been found in JeecgBoot 3.9.1. This issue affects some unknown processing of the file /openapi/call/ of the component OpenAPI Endpoint. Such manipulation leads to improper authentication. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way.
A flaw has been found in JeecgBoot 3.9.1. The impacted element is an unknown function of the file jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/LoginController.java of the component mLogin Endpoint. This manipulation causes authorization bypass. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/CommonController.java of the component SVG File Handler. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A security flaw has been discovered in JeecgBoot up to 3.9.1. This vulnerability affects the function CommonController.uploadImgByHttp/HttpFileToMultipartFileUtil.httpFileToMultipartFile/HttpFileToMultipartFileUtil.downloadImageData of the file CommonController.java of the component uploadImgByHttpEndpoint. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading the affected component is recommended. The vendor confirmed the issue and will provide a fix in the upcoming release.
A vulnerability was identified in JeecgBoot up to 3.9.1. This affects the function OpenApiController.add/OpenApiController.call of the file OpenApiController.java of the component OpenApi Service. Such manipulation of the argument originUrl database leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. It is suggested to upgrade the affected component. The vendor confirmed the issue and will provide a fix in the upcoming release.
A vulnerability was determined in JeecgBoot up to 3.9.1. Affected by this issue is the function checkPathTraversalBatch of the file FileDownloadUtils.jav of the component LoadFile Endpoint. This manipulation of the argument files causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The affected component should be upgraded. The vendor confirmed the issue and will provide a fix in the upcoming release.
A vulnerability was determined in JeecgBoot up to 3.9.1. Impacted is the function SqlInjectionUtil of the file jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/SqlInjectionUtil.java of the component loadDict Endpoint. This manipulation of the argument keyword causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Patch name: a9c8e8eb1185751c4c3c68d2a53f3dadee9edc6b. To fix this issue, it is recommended to deploy a patch.
A vulnerability has been found in JeecgBoot up to 3.9.1. Affected is the function isExistSqlInjectKeyword of the file /jeecg-boot/sys/api/getDictItems. Such manipulation leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
A weakness has been identified in JeecgBoot up to 3.9.0. Affected by this issue is some unknown functionality of the file /airag/knowledge/doc/edit of the component Retrieval-Augmented Generation Module. Executing a manipulation of the argument filePath can lead to path traversal. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was identified in JeecgBoot 3.9.0. This vulnerability affects unknown code of the file /JeecgBoot/sys/api/loadDictItemByKeyword of the component Online Report API. Such manipulation of the argument keyword leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
A weakness has been identified in JeecgBoot up to 3.9.0. Affected by this vulnerability is the function getPositionUserList of the file /sys/position/getPositionUserList. This manipulation of the argument positionId causes improper authorization. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.