CVE Catalog
CVE-2023-38991
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk0.39%
31th percentile - higher than 31% of all known CVEs
Summary
An issue in the delete function in the ActModelController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete models created by the Administrator.
Risk Assessment
Attackers can delete critical models, leading to data loss and disruption of system functionality.
Recommendation
It is recommended to update to the latest version of jeesite and implement additional access controls for the delete function.
Original NVD description (English source)
An issue in the delete function in the ActModelController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete models created by the Administrator.