Remote Code Execution Vulnerability in JFlyFox JFinalCMS by JFlyFox
CVE-2023-47503

9.8CRITICAL

Key Information:

Vendor

Jflyfox

Status
Jfinal Cms
Vendor
CVE Published:
28 November 2023

What is CVE-2023-47503?

An issue in JFlyFox JFinalCMS version 5.1.0 allows attackers to exploit vulnerabilities in the template management module. By submitting a specially crafted script to the login.jsp component, a remote attacker can execute arbitrary code, potentially compromising the security of the application and its users. It is crucial for organizations using this software to be aware of this vulnerability and apply appropriate security measures.

References

https://github.com/jflyfox/jfinal_cms/issues/58

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.