{"id":"CVE-2024-40489","aliases":["EUVD-2024-55519","GHSA-6pvg-7x86-xv8m"],"status":"published","title":"There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character...","description":"There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows attackers to execute arbitrary code on components through specially crafted HTTP requests.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00524,"percentile":0.4472,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2026-04-01T00:00:00Z","modified":"2026-11-09T10:10:00Z","products":[{"vendor":"jeecg","product":"jeecg_boot"}],"references":[{"url":"https://pan.baidu.com/s/14WOPXhRHoxr4FRKGme59ug?pwd=sktp","tags":["Permissions Required","web"]},{"url":"https://gist.github.com/aqyoung/2fd6329ceb06b731a621356921f0d5f0","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40489","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6pvg-7x86-xv8m"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/40xxx/CVE-2024-40489.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-40489","description":"There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows attackers to execute arbitrary code on components through specially crafted HTTP requests.","status":"published","published":"2026-04-01T00:00:00Z","modified":"2026-04-01T19:24:05.109Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:06.811965Z"}],"euvd":[{"id":"EUVD-2024-55519","description":"There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows attackers to execute arbitrary code on components through specially crafted HTTP requests.","status":"published","published":"2026-04-01T00:00:00Z","modified":"2026-04-01T19:24:05Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:25:23.620594Z"}],"ghsa":[{"id":"GHSA-6pvg-7x86-xv8m","title":"There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character...","description":"There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows attackers to execute arbitrary code on components through specially crafted HTTP requests.","status":"published","published":"2026-04-01T18:36:37Z","modified":"2026-04-01T21:30:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:07:04.885246Z"}],"nvd":[{"id":"CVE-2024-40489","description":"There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows attackers to execute arbitrary code on components through specially crafted HTTP requests.","status":"published","published":"2026-04-01T17:16:57.07Z","modified":"2026-11-09T10:10:00.217Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-09T12:13:54.574196Z"}],"osv":[{"id":"CVE-2024-40489","description":"There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows attackers to execute arbitrary code on components through specially crafted HTTP requests.","status":"published","published":"2026-04-01T00:00:00Z","modified":"2026-10-28T02:30:49.394077874Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:41.618074Z"}]}}