CVE-2025-3202 ageerle ruoyi-ai SysNoticeController.java improper authorization
Remote attackers can bypass authorization checks in the SysNoticeController to access or modify system notices without proper permissions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-3202?
CVE-2025-3202 is a medium-severity missing authorization vulnerability in ageerle ruoyi-ai, published on 4 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability classified as critical has been found in ageerle ruoyi-ai up to 2.0.0. Affected is an unknown function of the file ruoyi-modules/ruoyi-system/src/main/java/org/ruoyi/system/controller/system/SysNoticeController.java. The manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.1 is able to address this issue. The name of the patch is 6382e177bf90cc56ff70521842409e35c50df32d. It is recommended to upgrade the affected component.
Which versions are affected by CVE-2025-3202?
It affects 1 product.
Products include Ageerle Ruoyi-Ai.
How do I fix CVE-2025-3202?
No fix has been published for CVE-2025-3202 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-3202 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-3202 exists.
Other vulnerabilities in ageerle ruoyi-ai
Sources
Also known as GHSA-vf4w-gg7r-x8mw.