CVE-2023-51925
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
An arbitrary file upload vulnerability was found in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05. It allows an attacker to execute arbitrary code by uploading a crafted file.
Risk Assessment
The risk for the organization includes full compromise of the YonBIP system, potentially leading to data theft, service disruption, or lateral movement within the internal network.
Recommendation
It is recommended to immediately apply security patches provided by the vendor and restrict file upload functionality to trusted users only.
Original NVD description (English source)
An arbitrary file upload vulnerability in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05 allows attackers to execute arbitrary code via uploading a crafted file.