CVE Catalog
CVE-2023-38989
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk0.34%
26th percentile - higher than 26% of all known CVEs
Summary
An issue in the delete function in the UserController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete the Administrator's role information.
Risk Assessment
Attackers can remove critical information about Administrator permissions, potentially leading to loss of control over the system.
Recommendation
It is recommended to update to the latest version of jeesite and implement additional security measures to restrict access to the delete function.
Original NVD description (English source)
An issue in the delete function in the UserController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete the Administrator's role information.