CVE-2024-2827 is a Medium severity (CVSS 6.3) flaw in lakernote EasyAdmin up to the 20240315 snapshot: server-side request forgery in /ureport/designer/saveReportFile. The exploit is publicly disclosed. No fixed version is listed. Restrict access to the admin application and check the project page.
What's affected
- Product: lakernote EasyAdmin, a Java admin framework.
- Affected: versions up to 20240315.
- Fixed: none listed in the record.
- Weakness: CWE-918.
- Access needed: a low privilege account over the network (CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The record describes server-side request forgery in /ureport/designer/saveReportFile. VulDB tracks it as VDB-257717.
Severity note: VulDB labels this issue critical in its description, while the CVSS base score is 6.3 (Medium). Both appear in the record.
How to check if you're exposed
EasyAdmin is a Java project that you build and deploy yourself, so check your own source and build.
- Search your repositories for the project:
grep -rIl "com.laker.admin" . - Check the project snapshot or commit date. Anything at or before 15 March 2024 is in range.
- Check whether the admin application is reachable from the internet.
- Review your logs for unusual requests to the path named above.
What to do now
- Find every deployment or fork built from EasyAdmin.
- Restrict the admin application to a trusted network or VPN.
- Update to a build that includes the project's fix, and read the project's Gitee issue first to see what it says.
- Enforce strong credentials, since the vector needs a low privilege account.
- Rebuild and redeploy, then confirm the running build is newer than 20240315.
Why it matters
Server-side request forgery (SSRF) makes the server send requests to a destination the attacker chooses. Because the request comes from inside your network, it can reach services that are not exposed to the internet, such as admin interfaces and cloud metadata endpoints.
Defences include allow lists of destinations, blocking private address ranges, and not following redirects blindly.
The flaw sits in an admin framework, which is exactly the kind of component teams embed and forget. Four related CVEs in the same project came out on the same day, which suggests the code around report saving and URL fetching deserves a wider review rather than one by one fixes.
KEV status: the record has the CISA Known Exploited Vulnerabilities flag set to false, and none of the sources we could read says this is exploited in the wild. That can change, so watch for updates.
Quick check
Is the exploit public?
The record says the exploit has been disclosed to the public and may be used. It does not say it is used in attacks.
Which version is fixed?
The record does not name one. Check the project page.
Sources
Record references (not all retrievable when we reviewed this post):
- https://gitee.com/lakernote/easy-admin/issues/I98ZTA
- https://vuldb.com/?ctiid.257717
- https://vuldb.com/?id.257717
Last reviewed: 19 October 2026.
