CVE-2023-51928

CriticalCVSS 9.8

Published: 20/01/2024(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.82%

53th percentile - higher than 53% of all known CVEs

Summary

An arbitrary file upload vulnerability was found in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05. An attacker can upload a crafted file, leading to arbitrary code execution on the server.

Risk Assessment

The risk for the organization includes full server compromise, data theft, or installation of malware without requiring authentication.

Recommendation

Immediately update YonBIP to the latest version and implement file type validation and permission restrictions for file upload endpoints.

Original NVD description (English source)

An arbitrary file upload vulnerability in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05 allows attackers to execute arbitrary code via uploading a crafted file.