JeecgBoot CVE-2025-14909

Authentication is REQUIRED - the CVSS vector PR:L confirms the attacker must possess valid JeecgBoot login credentials. No special configuration or optional features need to be enabled; any JeecgBoot instance with the SysUserOnlineController exposed to authenticated users is vulnerable. The vulnerability does NOT require admin privileges (PR:L indicates low-privilege authenticated users can exploit it), making it actionable by any employee or contractor with system access. The attack is limited to authenticated personnel with network access to the JeecgBoot application; external attackers without valid credentials cannot exploit this vulnerability. The impact is restricted to session availability (VA:L) rather than data exposure, so the attacker cannot read sensitive information but can disrupt user access.

Despite the CVSS vector indicating network accessibility (AV:N), this vulnerability's real-world risk is constrained by multiple factors working in the defender's favor. CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N indicates authenticated access is required (PR:L), eliminating opportunistic worm-style propagation. The impact metrics (VC:N/VI:N/VA:L) show only low availability impact with no confidentiality or integrity compromise, suggesting the attack yields limited operational damage-likely disruption of session state rather than data exfiltration or system takeover. The EPSS score of 0.13% (32nd percentile) is notably low, placing this well below the median for exploitability despite public POC availability; this disconnect suggests the attack requires specific deployment contexts or authenticated user roles that are not universally present. CWE-1018's typical manifestations (UI layer bypass, frame injection) often require application logic errors rather than critical memory corruption. The 'E:P' extension attribute confirms POC exists and is public, but absence from CISA KEV suggests no confirmed active exploitation in the wild. Security teams should prioritize patching internet-facing instances or those with many authenticated users, but the low EPSS and limited impact scope indicate this is not a critical business risk for most organizations.

An authenticated user (e.g., standard employee with login credentials) makes a crafted HTTP request to the SysUserOnlineController endpoint that manipulates session state or forcibly terminates other users' sessions. Because the endpoint lacks proper authorization checks, the controller accepts the request and modifies session records in the backend, allowing the attacker to disrupt colleagues' access or potentially hijack administrative sessions if session identifiers are exposed in response messages.