PT-2023-30464 · Yonyou · Yongyou Ufida-Nc

Witcher · Publicado 2023-09-04 · Atualizado 2024-05-17 · CVE-2023-4748

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Yongyou UFIDA-NC versions up to 20230807

Description A critical issue has been found in the processing of the file PrintTemplateFileServlet.java, where the manipulation of the filePath argument leads to path traversal. This issue can be initiated remotely.

Recommendations For versions up to 20230807, as a temporary workaround, consider restricting access to the PrintTemplateFileServlet.java file to minimize the risk of exploitation. Avoid using the filePath argument in the affected processing until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-4748

Produtos afetados

Yongyou Ufida-Nc

Referências · 5

• 🔥❌ https://github.com/houseoforange/mybugs/blob/main/Yongyou-UFIDA-NC-Arbitrary-File-Read.pdf · Exploit, Deleted
• https://vuldb.com/?ctiid.238637 · Nota
• https://vuldb.com/?id.238637 · Nota
• https://twitter.com/CVEnew/status/1698944017789251812 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-4748 · Nota de Segurança