CVE Catalog
CVE-2023-38988
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk0.38%
30th percentile - higher than 30% of all known CVEs
Summary
An issue in the delete function in the OaNotifyController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete notifications created by Administrators.
Risk Assessment
Attackers can delete critical notifications, potentially leading to loss of important information and disruption of system operations.
Recommendation
It is recommended to update to the latest version of jeesite and implement additional access controls for the notification deletion function.
Original NVD description (English source)
An issue in the delete function in the OaNotifyController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete notifications created by Administrators.