CVE-2024-6680 is a medium severity (CVSS 6.3) SQL injection in witmy my-springsecurity-plus, in the /api/dept/build endpoint, in versions through 2024-07-04. It is a sibling of two other reports against the same project. No fix is named in the record, so check upstream and parameterize the query.
What's affected
The record lists witmy my-springsecurity-plus, described as affected up to 2024-07-04. That is a date, not a normal version number, so the project appears to be tracked by snapshot or commit date. The vulnerable endpoint is /api/dept/build, and the weak input is the params.dataScope argument.
The record names no fixed version. VulDB tracks this as VDB-271153, and the public report is a Gitee issue on the project (issue IAAH8A on gitee.com). Check the project repository for a commit that changes how dataScope reaches the database layer before you assume you are covered.
This is the second of three near neighbours in the CVE sequence, all with the same params.dataScope input and the same product. The other two cover /api/role and /api/dept, so a single fix in the shared data scope code would likely cover all three, though the record does not confirm that.
How to check if you're exposed
The /api/dept/build route sounds like it builds the department tree for an admin screen. Search your code for the controller behind it and for any shared helper that appends a data scope clause to a query.
grep -rn "dept/build\|dataScope" src/
If the helper is shared, one unsafe pattern may sit behind several endpoints. Fix the helper, not just the route, and then test every route that uses it.
What to do now
- Inventory any use of my-springsecurity-plus, including forks and internal copies.
- Review the shared data scope code and replace string concatenation with parameters.
- Test
/api/dept/build,/api/deptand/api/roletogether, since the report series covers all three. - Require authentication for these endpoints and limit network access to your admin users.
- Track the upstream issue IAAH8A and record the commit you adopt.
Why it matters
This is CWE-89 again. The interesting point is how a family of CVEs arrives from one underlying habit. When a project builds a data scope filter by concatenating text into SQL, every endpoint that calls it inherits the flaw. Scanners and researchers then file one report per endpoint, which is why you see three CVE numbers for what may be one coding pattern.
The vector needs a logged in user, which is why the score stays at 6.3 and not higher. Still, an admin framework often has many low privilege accounts. The record says the exploit is public, and it is not on the CISA known exploited list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for checking the packages your own projects pull in.
Quick check
Do I need to patch three times?
Not necessarily. The three CVEs share a parameter and a product, so one fix in shared code may close all of them. Test each route to be sure.
Does the attacker need an account?
Yes, the vector requires low privileges, but it is reachable over the network.
Sources
Last reviewed: 19 October 2026.
