PT-2023-26719 · Jeesite · Jeesite

Yanzhou-Felicity · Publicado 2023-08-01 · Atualizado 2023-08-05 · CVE-2023-38990

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions jeesite version 1.2.6

Description An issue in the delete function in the MenuController class allows authenticated attackers to arbitrarily delete menus created by the Administrator.

Recommendations For jeesite version 1.2.6, consider disabling the delete function in the MenuController class until a patch is available to prevent arbitrary deletion of menus. Restrict access to the MenuController class to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Identificadores relacionados

CVE-2023-38990

Produtos afetados

Jeesite

Referências · 5

• 🔥 https://github.com/thinkgem/jeesite/issues/519 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-38990 · Nota de Segurança
• https://t.me/cibsecurity/67553 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-38990 · Aviso do Fabricante
• https://t.me/cvenotify/55834 · Publicação no Telegram