CVE-2024-45944

CRITICAL
Published Oct 18, 2024 Modified Apr 16, 2025

Description

In J2eeFAST <=2.7, the backend function has unsafe filtering, which allows an attacker to trigger certain sensitive functions resulting in arbitrary code execution.

Is your site exposed to CVE-2024-45944?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor Product
j2eefast j2eefast

References

Frequently Asked Questions

What is CVE-2024-45944? +
In J2eeFAST <=2.7, the backend function has unsafe filtering, which allows an attacker to trigger certain sensitive functions resulting in arbitrary code execution. It has a CVSS v3.1 base score of 9.8 (CRITICAL).
How severe is CVE-2024-45944? +
CVE-2024-45944 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.
What products are affected by CVE-2024-45944? +
CVE-2024-45944 affects products from j2eefast, specifically: j2eefast. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2024-45944? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-35091 9.8

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysTenantMapper.xml.
CVE-2024-35086 9.8

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in BpmTaskFromMapper.xml .
CVE-2024-33164 9.8

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authUserList() function.
CVE-2024-33155 9.8

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the getDeptList() function.
CVE-2024-33153 9.8

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the commentList() function.
CVE-2024-35084 9.8

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysMsgPushMapper.xml.

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2024-45944 — free, no signup required.