CVE-2023-51926
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
YonBIP v3_23.05 was discovered to contain an arbitrary file read vulnerability via the nc.bs.framework.comn.serv.CommonServletDispatcher component. An attacker can exploit this flaw to read sensitive files from the server.
Risk Assessment
The risk involves unauthorized access to confidential configuration files, user data, or other system resources, potentially leading to information disclosure and security breaches for the organization.
Recommendation
It is recommended to immediately update YonBIP to the latest patched version and restrict access to the CommonServletDispatcher component to trusted networks only.
Other vulnerabilities in YonBIP
See all- CVE-2023-51925Critical
An arbitrary file upload vulnerability was found in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05. It allows an attacker to execute arbitrary code by uploading a crafted file.
- CVE-2023-51924Critical
An arbitrary file upload vulnerability in the uap.framework.rc.itf.IResourceManager interface of YonBIP v3_23.05. Attackers can upload a crafted file, leading to arbitrary code execution on the server.
- CVE-2023-51906Critical
An issue in YonBIP v3_23.05 from Yonyou allows a remote attacker to execute arbitrary code via a crafted script sent to the ServiceDispatcherServlet uap.framework.rc.itf.IResourceManager component.
- CVE-2023-51928Critical
An arbitrary file upload vulnerability was found in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05. An attacker can upload a crafted file, leading to arbitrary code execution on the server.
- CVE-2023-51927Critical
A SQL injection vulnerability was discovered in YonBIP v3_23.05 via the runScript() method of the AttendScriptController. An attacker can exploit this flaw to execute arbitrary SQL queries.
Original NVD description (English source)
YonBIP v3_23.05 was discovered to contain an arbitrary file read vulnerability via the nc.bs.framework.comn.serv.CommonServletDispatcher component.