CVE-2023-51906
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
An issue in YonBIP v3_23.05 from Yonyou allows a remote attacker to execute arbitrary code via a crafted script sent to the ServiceDispatcherServlet uap.framework.rc.itf.IResourceManager component.
Risk Assessment
An attacker could take control of the system, steal data, or disrupt business application operations, posing a serious threat to confidentiality, integrity, and availability.
Recommendation
Apply the vendor-supplied patch immediately or update YonBIP to a fixed version. Until then, restrict access to the ServiceDispatcherServlet component.
Other vulnerabilities in YonBIP
See all- CVE-2023-51925Critical
An arbitrary file upload vulnerability was found in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05. It allows an attacker to execute arbitrary code by uploading a crafted file.
- CVE-2023-51924Critical
An arbitrary file upload vulnerability in the uap.framework.rc.itf.IResourceManager interface of YonBIP v3_23.05. Attackers can upload a crafted file, leading to arbitrary code execution on the server.
- CVE-2023-51928Critical
An arbitrary file upload vulnerability was found in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05. An attacker can upload a crafted file, leading to arbitrary code execution on the server.
- CVE-2023-51927Critical
A SQL injection vulnerability was discovered in YonBIP v3_23.05 via the runScript() method of the AttendScriptController. An attacker can exploit this flaw to execute arbitrary SQL queries.
- CVE-2023-51926High
YonBIP v3_23.05 was discovered to contain an arbitrary file read vulnerability via the nc.bs.framework.comn.serv.CommonServletDispatcher component. An attacker can exploit this flaw to read sensitive files from the server.
Original NVD description (English source)
An issue in yonyou YonBIP v3_23.05 allows a remote attacker to execute arbitrary code via a crafted script to the ServiceDispatcherServlet uap.framework.rc.itf.IResourceManager component.