by Kastro
Paper/Archive/CVE-2022-23383

CVE-2022-23383

mitre — YzmCMS v6.3 is affected by broken access control.

EPSS 1%CVSS 9.1
critical.is priorityof 100
41
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 68.2.682 × 2013.6No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

YzmCMS v6.3 is affected by broken access control. Without login, unauthorized access to the user's personal home page can be realized. It is necessary to judge the user's login status before accessing the personal home page, but the vulnerability can access other users' home pages through the non login status because real authentication is not carried out.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

refdown.chinaz.com/soft/37810.htmrefcnvd.org.cn/user/myreport/6499961