PT-2023-26718 · Jeesite · Jeesite

Yanzhou-Felicity · Publicado 2023-07-31 · Atualizado 2023-08-04 · CVE-2023-38989

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions jeesite version 1.2.6

Description An issue in the delete function in the UserController class allows authenticated attackers to arbitrarily delete the Administrator's role information.

Recommendations For jeesite version 1.2.6, consider disabling the delete function in the UserController class until a patch is available to prevent arbitrary deletion of the Administrator's role information.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2023-38989

Produtos afetados

Jeesite

Referências · 5

• 🔥 https://github.com/thinkgem/jeesite/issues/518 · Exploit
• https://osv.dev/vulnerability/CVE-2023-38989 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-38989 · Nota de Segurança
• https://t.me/cibsecurity/67488 · Publicação no Telegram
• https://t.me/cvenotify/55767 · Publicação no Telegram