Medium severity · published Jan 28, 2022
CVE-2022-23889
The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments
5.3
CVSS
1.1%
EPSS
No
On KEV
Description
The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YZ
Yzmcms · Yzmcms
6.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23889
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23889
Exploit
https://github.com/yzmcms/yzmcms/issues/61
More from Yzmcms
9.8
CVE-2018-11554
The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly…
9.1
CVE-2022-23383
YzmCMS v6.3 is affected by broken access control
8.8
CVE-2020-23595
Cross Site Request Forgery (CSRF) vulnerability in yzmcms version 5.6, allows remote attackers to escalate privileges and gain sensitive information sitemodel/add.html endpoint
8.8
CVE-2022-23384
YzmCMS v6.3 is affected by Cross Site Request Forgery (CSRF) in /admin.add
8.8
CVE-2022-23888
YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html