VULNERABILITY INTELLIGENCE

CVE-2022-23383

CVSS score9.1 CRITICAL

EPSS probability1.20%

CISA KEVNot currently listed

Published2022-03-10

Last modified2026-07-09

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Description

YzmCMS v6.3 is affected by broken access control. Without login, unauthorized access to the user's personal home page can be realized. It is necessary to judge the user's login status before accessing the personal home page, but the vulnerability can access other users' home pages through the non login status because real authentication is not carried out.

Weakness classification

nvd@nist.gov: CWE-287

Primary references

cve@mitre.org — Product, Third Party Advisory
cve@mitre.org — Permissions Required, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Product, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Permissions Required, Third Party Advisory