CVE-2024-7314 is a critical (CVSS 9.8) authentication bypass in anji-plus AJ-Report. A remote attacker with no account can skip authentication and run arbitrary Java on the server. VulnCheck lists versions below 1.4.1 as affected, and exploitation evidence was observed in February 2025.
What's affected
The NVD record names anji-plus AJ-Report without a version range. The VulnCheck advisory says versions below 1.4.1 are affected. It does not name a fixed release in so many words, but 1.4.1 is the first version outside the affected range. Check the project's release notes before you rely on that, and prefer the newest release.
The weakness is CWE-288, authentication bypass using an alternate path or channel. In plain terms, one route into the application skips the check that guards the others. The record describes a crafted request suffix that causes the authentication filter to treat the request as allowed. We leave the exact form out on purpose.
The vector is AV:N/AC:L/PR:N/UI:N, the most favourable combination for an attacker, which is why the score is 9.8.
How to check if you're exposed
AJ-Report is a self hosted Java reporting and dashboard application, so the check is about your deployment.
- Find where AJ-Report runs. Search internal hosts and container registries for the application name.
- Read the version from the application's about page, the jar file name, or the container image tag.
- If the version is below 1.4.1, treat it as exposed.
- Check whether the service is reachable from the internet. Search results for exposed instances are one of the reasons exploitation spreads quickly.
- Look in web server and application logs for unusual requests to the Swagger path, and for new files or processes on the host.
What to do now
- Upgrade AJ-Report to 1.4.1 or later, and confirm the exact fixed release against the project's notes.
- If you cannot upgrade today, remove it from public access. Place it behind a VPN or an authenticating reverse proxy. This is a general precaution, not a vendor mitigation.
- Assume compromise if the instance was exposed while vulnerable. Check for unknown accounts, scheduled tasks, outbound connections and modified files.
- Rotate every credential the server could reach, including database passwords and API keys configured in its data sources.
- Review the Java process privileges. Run it as a low privilege user and keep it off sensitive networks.
Why it matters
Reporting tools sit close to data. They hold database connections, and they often run on internal networks with wide reach. An unauthenticated code execution flaw in one gives an attacker a trusted foothold.
The record notes that the Shadowserver Foundation observed exploitation evidence on 5 February 2025 UTC, and VulnCheck says it is in its KEV catalogue. The record's own kev field is false, which refers to the CISA catalogue, so there is a difference between sources. We treat the exploitation reports as real and the CISA flag as absent.
Public write ups and test environments for this issue exist, which lowers the effort needed to attack it. That is a reason to patch quickly. Reachability analysis helps here: knowing whether the vulnerable component is actually in your build and exposed lets you rank this above noise.
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2024-7314 exploited in the wild?
According to the record and the VulnCheck advisory, the Shadowserver Foundation observed exploitation evidence on 5 February 2025. The record does not flag it as a CISA KEV entry.
Which version fixes it?
VulnCheck lists versions below 1.4.1 as affected. Confirm the fixed release in the project's notes.
Sources
Last reviewed: 19 October 2026.
