anji-plus AJ-Report is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to HTTP requests to bypass authentication and execute arbitrary Java on the victim server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
References
| Link | Resource |
|---|---|
| https://github.com/vulhub/vulhub/tree/master/aj-report/CNVD-2024-15077 | Exploit Third Party Advisory |
| https://github.com/yuebusao/AJ-REPORT-EXPLOIT | Exploit |
| https://vulncheck.com/advisories/aj-report-swagger | Third Party Advisory |
| https://xz.aliyun.com/t/14460 | Exploit Third Party Advisory |
Configurations
History
20 Nov 2025, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) anji-plus AJ-Report is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to HTTP requests to bypass authentication and execute arbitrary Java on the victim server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC. |
20 Nov 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) anji-plus AJ-Report is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to HTTP requests to bypass authentication and execute arbitrary Java on the victim server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-19 UTC. | |
| References |
|
Information
Published : 2024-08-02 17:16
Updated : 2025-11-20 22:15
NVD link : CVE-2024-7314
Mitre link : CVE-2024-7314
CVE.ORG link : CVE-2024-7314
JSON object : View
Products Affected
anji-plus
- report
CWE