CVE-2023-54398

Name of the Vulnerable Software and Affected Versions Yonyou U8 Cloud (affected versions not specified)

Description An unauthenticated Java deserialization issue exists in the nc.impl.pub.filesystem.FileManageServlet component. Remote attackers can execute arbitrary OS commands by sending a serialized payload via a POST request. The flaw occurs in the doAction() function, which passes raw HTTP request body data directly to ObjectInputStream.readObject() without filtering, leading to remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.