PT-2023-30464 · Yonyou · Yongyou Ufida-Nc

Witcher · Published 2023-09-04 · Updated 2024-05-17 · CVE-2023-4748

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Yongyou UFIDA-NC versions up to 20230807

Description A critical issue has been found in the processing of the file PrintTemplateFileServlet.java, where the manipulation of the filePath argument leads to path traversal. This issue can be initiated remotely.

Recommendations For versions up to 20230807, as a temporary workaround, consider restricting access to the PrintTemplateFileServlet.java file to minimize the risk of exploitation. Avoid using the filePath argument in the affected processing until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-4748

Affected Products

Yongyou Ufida-Nc

References · 5

• 🔥❌ https://github.com/houseoforange/mybugs/blob/main/Yongyou-UFIDA-NC-Arbitrary-File-Read.pdf · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2023-4748 · Security Note
• https://vuldb.com/?ctiid.238637 · Note
• https://vuldb.com/?id.238637 · Note
• https://twitter.com/CVEnew/status/1698944017789251812 · Twitter Post