CVE-2024-40489

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-40489", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-04-01T19:24:05.109Z", "dateReserved": "2024-07-05T00:00:00.000Z", "datePublished": "2026-04-01T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-01T15:58:09.356Z"}, "descriptions": [{"lang": "en", "value": "There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows attackers to execute arbitrary code on components through specially crafted HTTP requests."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://pan.baidu.com/s/14WOPXhRHoxr4FRKGme59ug?pwd=sktp"}, {"url": "https://gist.github.com/aqyoung/2fd6329ceb06b731a621356921f0d5f0"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T19:22:30.196135Z", "id": "CVE-2024-40489", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T19:24:05.109Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-40489", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-01T19:22:30.196135Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T19:22:56.495Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://pan.baidu.com/s/14WOPXhRHoxr4FRKGme59ug?pwd=sktp"}, {"url": "https://gist.github.com/aqyoung/2fd6329ceb06b731a621356921f0d5f0"}], "descriptions": [{"lang": "en", "value": "There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows attackers to execute arbitrary code on components through specially crafted HTTP requests."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-01T15:58:09.356Z"}}}, "cveMetadata": {"cveId": "CVE-2024-40489", "state": "PUBLISHED", "dateUpdated": "2026-04-01T19:24:05.109Z", "dateReserved": "2024-07-05T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-04-01T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jeecg:jeecg_boot:*:*:*:*:*:*:*:*", "matchCriteriaId": "6EAE49E3-CDA2-49D8-B812-910C2FCA0C21", "versionEndIncluding": "3.5.3", "versionStartIncluding": "3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows attackers to execute arbitrary code on components through specially crafted HTTP requests."}, {"lang": "es", "value": "Existe una vulnerabilidad de inyecci\u00f3n en las versiones de jeecg boot desde la 3.0.0 hasta la 3.5.3 debido a un filtrado de caracteres deficiente, lo que permite a los atacantes ejecutar c\u00f3digo arbitrario en los componentes mediante solicitudes HTTP especialmente dise\u00f1adas."}], "id": "CVE-2024-40489", "lastModified": "2026-11-09T10:10:00.217", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-40489", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-01T19:22:30.196135Z", "version": "2.0.3"}}]}, "published": "2026-04-01T17:16:57.070", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://gist.github.com/aqyoung/2fd6329ceb06b731a621356921f0d5f0"}, {"source": "cve@mitre.org", "tags": ["Permissions Required"], "url": "https://pan.baidu.com/s/14WOPXhRHoxr4FRKGme59ug?pwd=sktp"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.5.3]"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 80.0, "source": "matching"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "jeecgboot", "vendor": "jeecg"}], "analysis": {"en": {"generated_at": "2026-04-06T20:22:35.314265+00:00", "value": {"mitigation_remediation": ["Upgrade to a Jeecg Boot release newer than 3.5.3 to eliminate the flaw.", "If an upgrade is not possible, tighten input validation by rejecting characters outside a strict whitelist to mitigate injection attempts.", "Deploy a web application firewall or similar perimeter protection to inspect and drop malformed or potentially malicious requests before they reach the application.", "Restrict exposure of the vulnerable system to trusted IP ranges or place it behind a VPN or internal network segment to reduce attack surface.", "Enable detailed logging and actively monitor HTTP traffic for unusual patterns that may indicate exploitation attempts."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "This vulnerability affects Jeecg Boot releases from version 3.0.0 through 3.5.3, inclusive. Any deployment of these versions that is reachable via HTTP is potentially exposed. No other products or earlier or later versions are currently known to be impacted.", "description_and_impact": "Jeecg Boot is vulnerable to a code injection flaw that lets an attacker execute arbitrary commands on the server. The weakness stems from insufficient character filtering in user\u2011supplied input, allowing specially crafted HTTP requests to be treated as executable code within the Java Virtual Machine. Compromise would grant full control over that instance, jeopardizing all data and services handled by the application.", "risk_and_exploitability": "The baseline CVSS score of 9.8 indicates extremely high severity, while the EPSS score below 1% suggests a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to send a crafted HTTP request to a vulnerable endpoint; the description does not specify required authentication, so the endpoint could be publicly accessible or may require valid credentials. In either case, an attacker can execute arbitrary code remotely if the endpoint is reachable."}}}}, "created": "2026-04-02T07:51:34.149713+00:00", "updated": "2026-04-07T08:07:51.263920+00:00", "vendors": ["jeecg", "jeecg$PRODUCT$jeecgboot"]}