CVE-2024-6679 is a medium severity (CVSS 6.3) SQL injection in the witmy my-springsecurity-plus project, in the /api/role endpoint, through the 2024-07-04 snapshot. The record names no fixed version, so check the project repository and treat the params.dataScope argument as untrusted until you have confirmed a patch.
What's affected
The record lists witmy my-springsecurity-plus, described as affected up to 2024-07-04. That is a date, not a normal version number, so the project appears to be tracked by snapshot or commit date. The vulnerable endpoint is /api/role, and the weak input is the params.dataScope argument.
The record names no fixed version. VulDB tracks this as VDB-271152, and the public report is a Gitee issue on the project (issue IAAHCR on gitee.com). Check the project repository for a commit that changes how dataScope reaches the database layer before you assume you are covered.
How to check if you're exposed
Start with your dependency and source inventory. If you copied or forked this Spring Security starter project, search your code for the /api/role route and for any place a dataScope value is joined into a SQL string.
A simple search is enough to locate the code:
grep -rn "dataScope" src/
The record says the attack can be launched remotely and needs low privileges, so any instance that is reachable by a logged in user is worth looking at first. If the app is only on an internal network, note that in your risk record, but do not stop there.
What to do now
- Find every deployment or fork of my-springsecurity-plus in your estate, including internal admin tools.
- Read the upstream Gitee issue and repository history for a fix, and record the commit you rely on.
- Where
dataScopeis built into SQL, switch to bound parameters or an allow list of known scope values. - Put the application behind authentication you control, and limit who can reach
/api/role. - Watch database logs for unusual queries coming from the role endpoint, then re-test after your change.
Why it matters
The weakness is CWE-89, SQL injection. A request parameter ends up inside a SQL statement without being separated from the query structure, so the database can read part of it as SQL. Here the parameter is params.dataScope, which in many admin frameworks controls row level visibility. That makes it a sensitive spot: it decides which rows a user may see.
The CVSS vector is network reachable, low complexity, low privileges, with low impact on confidentiality, integrity and availability. That is why it lands at 6.3. The record says the exploit has been disclosed publicly, which raises the odds that someone tries it. The record does not mark it as known exploited, and CISA's list does not include it. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for checking the packages your own projects pull in.
Quick check
Is a fix available?
The record does not name one. Check the project's Gitee repository and issue IAAHCR for a patch, and mitigate with parameterized queries in the meantime.
Why is the version a date?
The record says the issue affects the project up to 2024-07-04, which suggests the project does not publish numbered releases. Compare commit dates in your fork.
Sources
Last reviewed: 19 October 2026.
