CVEvulnerability

CVE-2022-23383

9.1 CRITICAL Published 2022-03-10 Modified 2026-07-09 Official page ↗
Status
Modified
Published
2022-03-10
Last modified
2026-07-09
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0 ([email protected])
6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
Weaknesses
CWE-287

Description

YzmCMS v6.3 is affected by broken access control. Without login, unauthorized access to the user's personal home page can be realized. It is necessary to judge the user's login status before accessing the personal home page, but the vulnerability can access other users' home pages through the non login status because real authentication is not carried out.

Affected configurations

• yzmcms yzmcms 6.3

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References