CVE-2024-0491 is a medium severity weak password recovery vulnerability in Huaxia ERP up to and including 3.1, scored CVSS 5.3. It affects src/main/java/com/jsh/erp/controller/UserController.java. The record says upgrading to 3.2 addresses it.
What's affected
The record names Huaxia ERP, version up to and including 3.1. The weakness is tracked as CWE-640. The affected code is src/main/java/com/jsh/erp/controller/UserController.java. The record says the issue can be reached remotely. It was published on 2024-01-13 and the VulDB identifier is VDB-250596.
The record says upgrading to version 3.2 addresses the issue. Confirm that against the vendor or project release notes before you rely on it.
How to check if you're exposed
Start with an inventory question: do you run Huaxia ERP at all? These are small standalone web applications, so they rarely show up in a package manager. Look for them as deployed source trees, not as installed packages. Check web roots, shared hosting accounts, internal tools servers and any container images built from a download of the project.
If you find a copy, confirm the version. The record lists up to and including 3.1. Then confirm that src/main/java/com/jsh/erp/controller/UserController.java exists in your tree. A command like this, run from the server or a checked out copy, will show whether the file is present:
grep -rn "huaxia\|jsh-erp\|jshERP" /srv /opt --include=pom.xml
If the file is present, assume the copy is affected until you have evidence otherwise. We have not seen a vendor advisory that describes a detection method, so there is no official check to point you to. Review the application's access logs for requests to that path from unexpected sources, and compare against normal use. Unusual or failing requests to a single page are worth a closer look. A log review cannot prove a copy was not abused, but it can help you scope the review.
Dependency scanners will not find a standalone application like this by itself. You can still use the free in-browser dependency scan at gold.safeguard.sh/scan on any project that vendors it as a library, and the Gold directory entry for CVE-2024-0491 tracks the record as it changes.
What to do now
- Find every deployed copy of Huaxia ERP, including test and staging servers and forgotten hosting accounts.
- Record the version of each copy. The record covers up to and including 3.1.
- Plan the upgrade to version 3.2 named in the record, and read the project release notes first to confirm what else changes.
- If the application does not need to be reachable from the internet, move it behind a VPN or an allow list of known addresses now.
- Review the recovery flow, require proof the requester owns the account, and expire recovery tokens quickly. Then review accounts for unexpected password changes.
- If you cannot patch and the software is not essential, plan to retire or replace it. Unmaintained sample style projects are poor candidates for holding real data.
Why it matters
Weak password recovery means the process for regaining access to an account can be abused by someone other than the account owner. Recovery flows are a common target because they sit outside the normal login checks. The record gives no steps and no detail beyond the weakness class and the affected controller file, and we will not add any.
A note on severity. The record's description text, taken from the VulDB entry, calls this issue problematic. The CVSS 3.1 base score attached to the record is 5.3, which is medium, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. Both are accurate descriptions of the same record, and they use different scales. For triage we use the CVSS score and the exposure of your own deployment. VulDB publishes its own scoring, which we could not retrieve.
CVE-2024-0491 is not on the CISA Known Exploited Vulnerabilities list. The description does not say whether exploit detail has been published, and no exploitation is recorded in the sources we could read. Remote reachability is still a reason to act on exposed copies.
Quick check
Is CVE-2024-0491 known to be exploited in the wild?
It is not on the CISA Known Exploited Vulnerabilities list, and the sources we could read do not report exploitation. Absence of a report is not proof of safety, so act on exposed copies anyway.
Is there a fixed version of Huaxia ERP?
The record says upgrading to version 3.2 addresses it. Check the project release notes to confirm.
Sources
- Gold entry for CVE-2024-0491
- NVD record for CVE-2024-0491, including the VulDB entry VDB-250596, as summarized in the Safeguard record file (we could not load the VulDB page or the linked researcher write up, so details beyond the record are not confirmed)
Last reviewed: 19 October 2026.
