PT-2023-26720 · Jeesite · Jeesite

Yanzhou-Felicity · Publicado 2023-08-03 · Atualizado 2023-08-08 · CVE-2023-38991

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions jeesite version 1.2.6

Description An issue in the delete function in the ActModelController class allows authenticated attackers to arbitrarily delete models created by the Administrator.

Recommendations For jeesite version 1.2.6, consider disabling the delete function in the ActModelController class until a patch is available to prevent arbitrary model deletion by authenticated attackers.

Exploit

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2023-38991

Produtos afetados

Jeesite

Referências · 4

• 🔥 https://github.com/thinkgem/jeesite/issues/520 · Exploit
• https://t.me/cibsecurity/67737 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-38991 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-38991 · Aviso do Fabricante