PT-2023-26718 · Jeesite · Jeesite

Yanzhou-Felicity · Published 2023-07-31 · Updated 2023-08-04 · CVE-2023-38989

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions jeesite version 1.2.6

Description An issue in the delete function in the UserController class allows authenticated attackers to arbitrarily delete the Administrator's role information.

Recommendations For jeesite version 1.2.6, consider disabling the delete function in the UserController class until a patch is available to prevent arbitrary deletion of the Administrator's role information.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-38989

Affected Products

Jeesite

References · 5

• 🔥 https://github.com/thinkgem/jeesite/issues/518 · Exploit
• https://osv.dev/vulnerability/CVE-2023-38989 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38989 · Security Note
• https://t.me/cibsecurity/67488 · Telegram Post
• https://t.me/cvenotify/55767 · Telegram Post