CVE-2025-67342

RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. While the endpoint is protected by an XSS filter, the protection can be bypassed. Additionally, because the menu is shared across all users, any user with menu modification permissions can impact all users by exploiting this stored XSS vulnerability.

CVSS v3 4.6 MEDIUM

4.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/yangzongzhuan/RuoYi/issues/308	Exploit Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ruoyi:ruoyi:*:*:*:*:*:*:*:*

History

14 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Las versiones 4.8.1 y anteriores de RuoYi están afectadas por una vulnerabilidad XSS almacenado en el endpoint /system/menu/edit. Aunque el endpoint está protegido por un filtro XSS, la protección puede ser eludida. Además, debido a que el menú es compartido entre todos los usuarios, cualquier usuario con permisos de modificación de menú puede impactar a todos los usuarios al explotar esta vulnerabilidad XSS almacenado.

Information

Published : 2025-12-12 17:15

Updated : 2026-10-14 20:10

NVD link : CVE-2025-67342

Mitre link : CVE-2025-67342

CVE.ORG link : CVE-2025-67342

JSON object : View

Products Affected

ruoyi

ruoyi

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-67342", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67342", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-12T19:16:40.223126Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.1}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-12T17:15:45.477", "references": [{"url": "https://github.com/yangzongzhuan/RuoYi/issues/308", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. While the endpoint is protected by an XSS filter, the protection can be bypassed. Additionally, because the menu is shared across all users, any user with menu modification permissions can impact all users by exploiting this stored XSS vulnerability."}, {"lang": "es", "value": "Las versiones 4.8.1 y anteriores de RuoYi est\u00e1n afectadas por una vulnerabilidad XSS almacenado en el endpoint /system/menu/edit. Aunque el endpoint est\u00e1 protegido por un filtro XSS, la protecci\u00f3n puede ser eludida. Adem\u00e1s, debido a que el men\u00fa es compartido entre todos los usuarios, cualquier usuario con permisos de modificaci\u00f3n de men\u00fa puede impactar a todos los usuarios al explotar esta vulnerabilidad XSS almacenado."}], "lastModified": "2026-10-14T20:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ruoyi:ruoyi:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "900166F8-5C48-4DE0-A6AF-5DB981C0EFCD", "versionEndIncluding": "4.8.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}