Medium severity · published Dec 28, 2023
CVE-2023-7133
y_project RuoYi HTTP POST Request login cross site scripting
6.1
CVSS
0.7%
EPSS
No
On KEV
Description
A vulnerability was found in y_project RuoYi 4.7.8. It has been declared as problematic. This vulnerability affects unknown code of the file /login of the component HTTP POST Request Handler. The manipulation of the argument rememberMe with the input falsen3f0m<script>alert(1)</script>p86o0 leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249136.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RU
RuoYi · y_project
4.7.8 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-7133
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-7133
Exploit
https://1drv.ms/w/s!AgMfVZkPO1NWgSPnwk90DMQIUN_D?e=2Bauy4
Permissions Required
https://vuldb.com/?ctiid.249136
Third Party Advisory
https://vuldb.com/?id.249136
More from RuoYi
9.8
CVE-2022-4566
y_project RuoYi GenController sql injection
7.5
CVE-2023-3163
y_project RuoYi filterKeyword resource consumption
7.2
CVE-2025-0734
y_project RuoYi Whitelist getBeanName deserialization
6.1
CVE-2024-9048
y_project RuoYi Backend User Import SysUserServiceImpl.java SysUserServiceImpl cross site scripting
6.1
CVE-2024-6511
y_project RuoYi Content-Type isJsonRequest cross site scripting