CVE-2023-51924
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
An arbitrary file upload vulnerability in the uap.framework.rc.itf.IResourceManager interface of YonBIP v3_23.05. Attackers can upload a crafted file, leading to arbitrary code execution on the server.
Risk Assessment
Risk of server compromise through remote code execution. This may result in loss of confidentiality, integrity, and availability of data and the system.
Recommendation
Immediately update YonBIP to the latest version and implement file validation and filtering mechanisms. Restrict access to the interface to trusted users only.
Other vulnerabilities in YonBIP
See all- CVE-2023-51925Critical
An arbitrary file upload vulnerability was found in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05. It allows an attacker to execute arbitrary code by uploading a crafted file.
- CVE-2023-51906Critical
An issue in YonBIP v3_23.05 from Yonyou allows a remote attacker to execute arbitrary code via a crafted script sent to the ServiceDispatcherServlet uap.framework.rc.itf.IResourceManager component.
- CVE-2023-51928Critical
An arbitrary file upload vulnerability was found in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05. An attacker can upload a crafted file, leading to arbitrary code execution on the server.
- CVE-2023-51927Critical
A SQL injection vulnerability was discovered in YonBIP v3_23.05 via the runScript() method of the AttendScriptController. An attacker can exploit this flaw to execute arbitrary SQL queries.
- CVE-2023-51926High
YonBIP v3_23.05 was discovered to contain an arbitrary file read vulnerability via the nc.bs.framework.comn.serv.CommonServletDispatcher component. An attacker can exploit this flaw to read sensitive files from the server.
Original NVD description (English source)
An arbitrary file upload vulnerability in the uap.framework.rc.itf.IResourceManager interface of YonBIP v3_23.05 allows attackers to execute arbitrary code via uploading a crafted file.