CVE-2025-28403

Status: AnalyzedHigh (7.2)—

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the requesting user has administrative privileges before allowing modifications to system configuration settings

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Base score: 7.2

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.61%
Percentile among all scored CVEs: 48
Score date: 10/6/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1210 Exploitation of Remote Serviceslateral movement85 %
Primary impactT1068 Exploitation for Privilege Escalationprivilege escalation80 %
Secondary impactT1565.001 Stored Data Manipulationimpact75 %

Acceso remoto con privilegios elevados (PR:H) sin interacción. Falta validación de permisos en método editSave permitiendo escalada de privilegios en RUoYi v4.8.0, resultando en modificación de configuración del sistema.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Threat Intelligence Program Application Isolation and Sandboxing Exploit Protection Update Software Vulnerability Scanning Restrict File and Directory Permissions

Affected technologies (1)

Ruoyi — Ruoyi

CWEs

CWE-284

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2025-28403",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-28403",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-08T19:38:40.360303Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-04-07T16:15:24.493",
  "references": [
    {
      "url": "https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28403.md",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/yangzongzhuan/RuoYi",
      "tags": [
        "Product"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28403.md",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the requesting user has administrative privileges before allowing modifications to system configuration settings"
    },
    {
      "lang": "es",
      "value": "Un problema en RUoYi v.4.8.0 permite que un atacante remoto escale privilegios a través del método editSave y no valida correctamente si el usuario solicitante tiene privilegios administrativos antes de permitir modificaciones en la configuración del sistema."
    }
  ],
  "lastModified": "2026-06-17T09:04:44.850",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ruoyi:ruoyi:4.8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1248589F-5F63-4535-B2C9-EBBA85EA6D83"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}