CVE-2024-53477

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-53477
JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://gist.github.com/kaoniniang2/c2deceea281fcd0aec5a8165183be3c1 Third Party Advisory Issue Tracking
https://github.com/jflyfox/jfinal_cms/releases/tag/v5.1.0 Release Notes
Configurations

Configuration 1 (hide)

cpe:2.3:a:jflyfox:jfinal_cms:5.1.0:*:*:*:*:*:*:*
History

25 Nov 2025, 13:44

Type Values Removed Values Added
References () https://gist.github.com/kaoniniang2/c2deceea281fcd0aec5a8165183be3c1 - () https://gist.github.com/kaoniniang2/c2deceea281fcd0aec5a8165183be3c1 - Third Party Advisory, Issue Tracking
References () https://github.com/jflyfox/jfinal_cms/releases/tag/v5.1.0 - () https://github.com/jflyfox/jfinal_cms/releases/tag/v5.1.0 - Release Notes
CPE cpe:2.3:a:jflyfox:jfinal_cms:5.1.0:*:*:*:*:*:*:*
First Time Jflyfox jfinal Cms
Jflyfox

11 Dec 2024, 16:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
CWE CWE-502
Summary
  • (es) JFinal CMS 5.1.0 es vulnerable a la ejecución de comandos a través de la ejecución no autorizada de la deserialización en el archivo ApiForm.java

02 Dec 2024, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-02 21:15

Updated : 2025-11-25 13:44

NVD link : CVE-2024-53477

Mitre link : CVE-2024-53477

CVE.ORG link : CVE-2024-53477

JSON object : View

Products Affected

jflyfox

  • jfinal_cms
CWE
CWE-502

Deserialization of Untrusted Data