Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2024-22497
CVE-2024-22497:
Java vulnerability analysis and mitigation
Overview
A Cross Site Scripting (XSS) vulnerability has been identified in JFinalcms version 5.0.0, specifically in the /admin/login password parameter. This vulnerability was assigned CVE-2024-22497 and was initially disclosed on January 23, 2024. The vulnerability affects JFinalcms installations running version 5.0.0 (NVD, CVE).
Technical details
The vulnerability exists in the password parameter of the /admin/login endpoint. The issue stems from improper handling of user input where the #(password) syntax is used to reserve variables in forms. When the form is submitted, this position is replaced with the actual user-entered value without proper sanitization. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (NVD).
Impact
The vulnerability allows attackers to execute arbitrary web script code through a crafted URL. This can potentially lead to the theft of sensitive information such as cookies and session tokens from users who access the affected login page (GitHub POC).
Additional resources
Source: This report was generated using AI
Related Java vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management