PatchTheCVECVE-2024-6679: A vulnerability classified as critical has been found in witmy my-springsecurity-plus up to 2024-07-04
CVE-2024-6679 is a medium-severity flaw (CVSS 6.3) affecting my-springsecurity-plus. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability classified as critical has been found in witmy my-springsecurity-plus up to 2024-07-04. Affected is an unknown function of the file /api/role. The manipulation of the argument params.dataScope leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271152.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.6% (top 53%) |
| CISA exploited list | No |
| Weakness | CWE-89 |
| Published | 2024-07-11 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-6679?
my-springsecurity-plus: upgrade to newer than 2024-07-04. Exact commands for each OS are on this page.
Is CVE-2024-6679 being exploited?
CVE-2024-6679 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-6679 affect?
CVE-2024-6679 affects my-springsecurity-plus. Severity is medium (CVSS 6.3). A vulnerability classified as critical has been found in witmy my-springsecurity-plus up to 2024-07-04. Affected is an unknown function of the file /api/role. The manipulation of the argument params.dataScope leads to sql injection. It is p
How urgent is CVE-2024-6679?
Priority 34/100. No elevated risk signals yet.
Related CVEs
- CVE-2024-6681 MEDIUM 6.3 UPGRADE A vulnerability, which was classified as critical, has been found in witmy my-springsecurity-plus up to 2024-0
- CVE-2024-6680 MEDIUM 6.3 UPGRADE A vulnerability classified as critical was found in witmy my-springsecurity-plus up to 2024-07-04
- CVE-2024-6676 MEDIUM 6.3 UPGRADE A vulnerability has been found in witmy my-springsecurity-plus up to 2024-07-03 and classified as critical
- CVE-2024-40542 CRITICAL 9.8 UPGRADE my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the data
- CVE-2024-40541 CRITICAL 9.8 UPGRADE my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the data