Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-3199

A vulnerability was found in ageerle ruoyi-ai up to 2.0.1 and classified as critical. Affected by this issue is some unknown functionality of the file ruoyi-modules/ruoyi-system/src/main/java/org/ruoyi/system/controller/system/SysModelController.java of the component API Interface. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.2 is able to address this issue. The name of the patch is c0daf641fb25b244591b7a6c3affa35c69d321fe. It is recommended to upgrade the affected component.

Published

2025-04-04T02:15:19.013

Last Modified

2025-12-08T19:07:47.353

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 7.3 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

10.0

Impact Score

6.4

Weaknesses

Type: Secondary
CWE-266
CWE-285

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	pandarobot	ruoyi_ai	< 2.0.2	Yes

References

https://github.com/Tr0e/CVE_Hunter/blob/main/ruoyi-ai/ruoyi-ai_UnauthorizedAccess_01.md Exploit, Third Party Advisory ([email protected])
https://github.com/ageerle/ruoyi-ai/issues/43 Exploit, Issue Tracking ([email protected])
https://github.com/ageerle/ruoyi-ai/issues/43#issuecomment-2763091490 Issue Tracking ([email protected])
https://github.com/ageerle/ruoyi-ai/releases/tag/v2.0.2 Release Notes ([email protected])
https://github.com/gwozai/ruoyi-ai/commit/c0daf641fb25b244591b7a6c3affa35c69d321fe Patch ([email protected])
https://vuldb.com/?ctiid.303152 Permissions Required, VDB Entry ([email protected])
https://vuldb.com/?id.303152 Third Party Advisory, VDB Entry ([email protected])
https://vuldb.com/?submit.545830 Third Party Advisory, VDB Entry ([email protected])
https://github.com/Tr0e/CVE_Hunter/blob/main/ruoyi-ai/ruoyi-ai_UnauthorizedAccess_01.md Exploit, Third Party Advisory (134c704f-9b21-4f2e-91b3-4a467353bcc0)