Vulnerabilities in pkg:maven/com.jfinal/jfinal

PACKAGE
Advisory Identifier: GHSA-qh2w-9m7w-hjg2
Share
Advisory Summary

CVE-2024-22497 is a MODERATE (CVSS 6.1) cross-site scripting vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) affecting Jfinal libraries in the Maven ecosystem. The issue involves cross-site scripting in jfinal. Remediation is available in the latest vendor maintenance releases.

36 Known Advisory Record(s)
Package Vulnerability Intelligence

pkg:maven/com.jfinal/jfinal

36 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:maven/com.jfinal/jfinal. Select an advisory below to view technical details or fixes.

Advisory ID CVE / NVD Severity Summary
GHSA-qh2w-9m7w-hjg2 CVE-2024-22497 MODERATE Cross-site Scripting in JFinal
GHSA-v435-pfj6-68r3 CVE-2024-22496 MODERATE Cross-site Scripting in JFinal
GHSA-859h-4w58-78xw CVE-2024-22492 MODERATE Cross-site Scripting in JFinal
GHSA-3j4x-9q9q-3277 CVE-2024-22493 MODERATE Cross-site Scripting in JFinal
GHSA-xv7p-jw46-8r85 CVE-2023-50137 MODERATE Cross-site Scripting in JFinalcms
GHSA-p3ph-6245-4wfc CVE-2023-50102 MODERATE Cross-site Scripting in JFinalcms
GHSA-m3p6-43xj-pf9v CVE-2023-50101 MODERATE Cross-site Scripting in JFinalcms
GHSA-3hf6-f8ch-5869 CVE-2023-50100 MODERATE Cross-site Scripting in JFinalcms
GHSA-7x2g-4jvc-4x6p CVE-2023-50449 HIGH Directory Traversal in JFinalCMS
GHSA-f2w8-4m48-5qrq CVE-2023-49485 MODERATE Cross-site Scripting in JFinalCMS
GHSA-hjfp-2j7q-xmx4 CVE-2023-49486 MODERATE Cross-site Scripting in JFinalCMS
GHSA-m42v-qv3c-h6j7 CVE-2023-49487 MODERATE Cross-site Scripting in JFinalCMS
GHSA-pv3g-vc3q-8c9g CVE-2023-49448 HIGH Cross-Site Request Forgery in JFinalCMS via admin/nav/delete
GHSA-32j2-c7mx-v4jj CVE-2023-49447 HIGH Cross-Site Request Forgery in JFinalCMS via /admin/nav/update
GHSA-hv4c-v8j8-54cw CVE-2023-49446 HIGH Cross-Site Request Forgery in JFinalCMS via /admin/nav/save
GHSA-mwvq-gc5w-m78f CVE-2023-49398 HIGH Cross-Site Request Forgery in JFinalCMS via /admin/category/delete
GHSA-5f56-h6fg-rcrh CVE-2023-49397 HIGH Cross-Site Request Forgery in JFinalCMS via /admin/category/updateStatus
GHSA-882g-gjqp-9vjp CVE-2023-49396 HIGH Cross-Site Request Forgery in JFinalCMS via /admin/category/save
GHSA-6v55-h6m5-2352 CVE-2023-49382 HIGH Cross-Site Request Forgery in JFinalCMS via /admin/div/delete
GHSA-rq2q-hc6h-2px2 CVE-2023-49383 HIGH Cross-Site Request Forgery in JFinalCMS via /admin/tag/save
GHSA-8hch-q86g-j38w CVE-2023-49395 HIGH Cross-Site Request Forgery in JFinalCMS via /admin/category/update
GHSA-r222-mcff-27ff CVE-2023-49381 HIGH Cross-Site Request Forgery in JFinalCMS via /admin/div/update
GHSA-r7w2-j96v-vw8m CVE-2023-49374 HIGH Cross-Site Request Forgery in JFinalCMS via /admin/slide/update
GHSA-765f-3mgx-24pw CVE-2023-49380 HIGH Cross-Site Request Forgery in JFinalCMS via /admin/friend_link/delete
GHSA-r2wj-mxvh-wqfh CVE-2023-49379 HIGH Cross-Site Request Forgery in JFinalCMS via the component /admin/friend_link/save
GHSA-gw26-cchc-8f2f CVE-2023-49378 HIGH Cross-Site Request Forgery in JFinalCMS via /admin/form/save
GHSA-r6mg-fq87-gw34 CVE-2023-49377 HIGH Cross-Site Request Forgery in JFinalCMS via /admin/tag/update
GHSA-gfhv-xxqj-h323 CVE-2023-49375 HIGH Cross-Site Request Forgery in JFinalCMS via /admin/friend_link/update
GHSA-w492-7g9m-j2ww CVE-2023-49376 HIGH Cross-Site Request Forgery in JFinalCMS
GHSA-9wvj-wr2f-6mx6 CVE-2023-49372 HIGH Cross-Site Request Forgery in JFinalCMS
GHSA-cj7j-23wf-mhrx CVE-2023-49373 HIGH Cross-Site Request Forgery in JFinalCMS
GHSA-h3j8-fr5q-8rfr CVE-2021-31649 CRITICAL JFinal Java Deserialization Vulnerability
GHSA-cgmm-c2m9-ff7r CVE-2021-31635 CRITICAL jFinal Server-Side Template Injection vulnerability
GHSA-9pvq-4cc7-24jg CVE-2022-33113 MODERATE Cross-site Scripting in Jfinal CMS
GHSA-279p-pc38-xx4p CVE-2019-17352 HIGH JFinal file validation vulnerability
GHSA-2c25-xfpq-8w9r CVE-2021-33348 MODERATE Cross-site scripting in jfinal

CVE-2024-22497 at a Glance

CVE Identifier CVE-2024-22497
GHSA Identifier GHSA-qh2w-9m7w-hjg2
Severity MODERATE
CVSS v3.1 Base Score 6.1
CWE Classification CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Product Jfinal
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 6.1

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction Required (UI:R)
Scope Changed (S:C)
Confidentiality Low (C:L)
Integrity Low (I:L)
Availability None (A:N)

How to Fix CVE-2024-22497

To remediate this vulnerability, upgrade all affected Jfinal dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

com.jfinal:jfinal fixed: Latest secure release 
<dependency>
    <groupId>com.jfinal</groupId>
    <artifactId>jfinal</artifactId>
    <version>Latest secure release</version>
</dependency>
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree -Dincludes=com.jfinal

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2024-22497, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree -Dincludes=com.jfinal

Analyze the terminal output to locate any version of Jfinal in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree -Dincludes=com.jfinal command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), where the product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. In Jfinal, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL.

CVE-2024-22497 Affected Jfinal Versions

1 component(s)
Product / Package Ecosystem Affected Versions Fixed Version
com.jfinal:jfinal
maven/com.jfinal/jfinal
Maven
≤ 5.0.0

References

NVD — CVE-2024-22497 NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-22497
Jfinal Source Repository REPOSITORY
https://github.com/cui2shark/security/blob/main/%28JFinalcms%20admin-login-password%29%20.md

Frequently Asked Questions

What is CVE-2024-22497?
CVE-2024-22497 is a security vulnerability in Jfinal involving Cross-site Scripting in JFinal under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Which Jfinal versions are affected?
Affected versions include releases prior to current release patches across affected packages: com.jfinal:jfinal.
What version fixes CVE-2024-22497?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
Is jfinal affected?
Yes, com.jfinal:jfinal is affected in releases prior to Latest secure release. Upgrade your dependency to Latest secure release or later.
What is the CVSS score of CVE-2024-22497?
CVE-2024-22497 has a CVSS v3.1 base score of 6.1 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
What CWE is associated with CVE-2024-22497?
CVE-2024-22497 is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.).
How can I check Maven dependencies for CVE-2024-22497?
Run the dependency tree command: 'mvn dependency:tree -Dincludes=com.jfinal'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-qh2w-9m7w-hjg2",
  "modified" : "2024-01-29T19:12:47Z",
  "published" : "2024-01-23T21:30:20Z",
  "aliases" : [ "CVE-2024-22497" ],
  "summary" : "Cross-site Scripting in JFinal",
  "details" : "Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "com.jfinal:jfinal"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "5.0.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-22497"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/cui2shark/security/blob/main/%28JFinalcms%20admin-login-password%29%20.md"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-01-24T14:22:02Z",
    "nvd_published_at" : "2024-01-23T19:15:08Z"
  }
}