Summaryinfo

A vulnerability, which was classified as critical, was found in Yonyou YonBIP 3_23.05. Impacted is an unknown function of the component nc.bs.framework.comn.serv.CommonServletDispatcher. The manipulation results in path traversal. This vulnerability is reported as CVE-2023-51926. No exploit exists. It is advisable to implement a patch to correct this issue. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Yonyou YonBIP 3_23.05. Affected is some unknown functionality of the component nc.bs.framework.comn.serv.CommonServletDispatcher. The manipulation with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality. CVE summarizes:

YonBIP v3_23.05 was discovered to contain an arbitrary file read vulnerability via the nc.bs.framework.comn.serv.CommonServletDispatcher component.

The weakness was disclosed 01/20/2024. This vulnerability is traded as CVE-2023-51926 since 12/26/2023. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1006.

Applying a patch is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Yonyou

Name

• YonBIP

Version

• 3_23.05

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion