CVE-2024-5352 is a critical deserialization vulnerability affecting anji-plus AJ-Report up to version 1.4.1, specifically within the validationRules function of the DataSetParamController. This flaw allows for remote exploitation, enabling an unauthenticated attacker to execute arbitrary code with severe consequences for confidentiality, integrity, and availability. While public exploit disclosure exists, there is currently no evidence of active exploitation, Metasploit/Nuclei modules, or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.4.1CPE matchmatch criteria | cpe:2.3:a:anji-plus:aj-report:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.