CVE-2025-15124 Details

A vulnerability exists in JeecgBoot versions prior to 3.9.0, specifically in the department permission list query endpoint. The issue arises in the 'getParameterMap' function of the '/sys/sysDepartPermission/list' file, where the 'departId' parameter is not properly validated for tenant ownership. This lack of validation allows attackers to access department permission configurations of other tenants by specifying arbitrary department IDs. The vulnerability can be exploited remotely and is considered to have a high complexity, with difficult exploitability. However, a public exploit is available.

Implement tenant ownership validation for the 'departId' parameter to ensure that only authorized department data is accessed. This can be done by checking if the department belongs to the current tenant before processing the request. Additionally, consider adding database-level tenant isolation and configuring audit logging to record department permission query operations, especially cross-tenant access attempts.