CVE-2022-23383
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk64th percentile - higher than 64% of all known CVEs
Summary
YzmCMS v6.3 is affected by a broken access control vulnerability that allows unauthorized access to users' personal home pages without login. The issue arises from missing authentication checks before accessing the home page, enabling attackers to view other users' pages while not logged in.
Risk Assessment
The risk involves potential exposure of personal user data and privacy breaches, as an attacker can access other users' profiles without authorization.
Recommendation
It is recommended to immediately update YzmCMS to the latest version that fixes this vulnerability and implement proper authentication mechanisms before accessing personal pages.
Original NVD description (English source)
YzmCMS v6.3 is affected by broken access control. Without login, unauthorized access to the user's personal home page can be realized. It is necessary to judge the user's login status before accessing the personal home page, but the vulnerability can access other users' home pages through the non login status because real authentication is not carried out.