Vulnerability · Published Apr 4, 2025 · Assigned by VulDB

CVE-2025-3202ageerle ruoyi-ai SysNoticeController.java improper authorization

High 7.3

In plain English

A high-severity security flaw in ruoyi-ai from ageerle. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.5%top 54.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as critical has been found in ageerle ruoyi-ai up to 2.0.0. Affected is an unknown function of the file ruoyi-modules/ruoyi-system/src/main/java/org/ruoyi/system/controller/system/SysNoticeController.java. The manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.1 is able to address this issue. The name of the patch is 6382e177bf90cc56ff70521842409e35c50df32d. It is recommended to upgrade the affected component.

Affected products (as reported)

Vendor	Product	Versions
ageerle	ruoyi-ai	2.0

Weakness: CWE-285, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

VDB-303156 | ageerle ruoyi-ai SysNoticeController.java improper authorization vdb-entry
VDB-303156 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #545866 | ageerle https://github.com/ageerle/ruoyi-ai 20250328 version Unauthorized access vulnerability third-party-advisory
https://github.com/Tr0e/CVE_Hunter/blob/main/ruoyi-ai/ruoyi-ai_UnauthorizedAccess_02.md related
https://github.com/ageerle/ruoyi-ai/issues/44#issue-2957771318 exploit, issue-tracking
https://github.com/ageerle/ruoyi-ai/commit/6382e177bf90cc56ff70521842409e35c50df32d patch
https://github.com/ageerle/ruoyi-ai/releases/tag/v2.0.1 patch