CVE-2023-54403
waiting for further signalsZero needs more public information before it can validate it.GHSA-8vgx-v6gm-mhxr ↗EUVD-2023-60699 ↗
description
Yonyou U8 CRM releases before V16.5 and V18 are affected by an arbitrary file-read issue in an email-data endpoint. An unauthenticated attacker who can reach the endpoint may read files outside the web application directory, potentially exposing configuration data and credentials.
mitigation
Restrict external access to U8 CRM and block unauthenticated access to the affected email-data endpoint at the reverse proxy or web server. Apply vendor-supported remediation when available; no fixed version is recorded in the advisory.
outcome
No artifact: an exploit or check was attempted but could not be produced at this moment.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-09-30 00:00Z
- 2026-09-30 20:25Zcve_org: trigger signal, started the run
- 2026-10-11 23:32Z
this entry in the feed
GET /api/v1/feed/CVE-2023-54403
{ "etk_id": "ETK-2026-151", "cve_id": "CVE-2023-54403", "display_id": "CVE-2023-54403", "ghsa_id": "GHSA-8vgx-v6gm-mhxr", "euvd_id": "EUVD-2023-60699", "status": "published", "anchor_state": "anchored", "title": "Unauthenticated arbitrary file read in Yonyou U8 CRM", "summary": "Yonyou U8 CRM releases before V16.5 and V18 are affected by an arbitrary file-read issue in an email-data endpoint. An unauthenticated attacker who can reach the endpoint may read files outside the web application directory, potentially exposing configuration data and credentials.", "mitigation": "Restrict external access to U8 CRM and block unauthenticated access to the affected email-data endpoint at the reverse proxy or web server. Apply vendor-supported remediation when available; no fixed version is recorded in the advisory.", "vendor": "Yonyou", "product": "U8 CRM", "affected": [ { "affected_notes": [], "affected_ranges": [ "16.1", "16.0", "15.1", "13" ], "ecosystem": null, "fixed_versions": [], "package_name": "U8 CRM", "purl": null } ], "cwes": [ 22 ], "cvss_score": 8.7, "cvss_src": "cna_vendor", "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "epss_score": 0.0046, "epss_percentile": 0.3864, "epss_asof": "2026-10-20", "automation": "deterministic", "check": false, "check_confidence_basis": null, "exploit": false, "pipeline_minutes": 20.958476966666666, "t0_at": "2026-09-30T20:25:40.223000+00:00", "signals": { "kev": { "at": "2026-09-30T00:00:00+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-09-30T20:25:40.223000+00:00", "precision": "day", "url": "https://vulncheck.com/cve/CVE-2023-54403" }, "public_poc": { "at": "2026-09-30T20:25:40.223000+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-09-30T20:25:40.223000+00:00", "url": "https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E7%94%A8%E5%8F%8BOA/%E7%94%A8%E5%8F%8B%20U8%20CRM%E5%AE%A2%E6%88%B7%E5%85%B3%E7%B3%BB%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20getemaildata.php%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md" }, "trigger_signal": { "at": "2026-09-30T20:25:40.223000+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-09-30T20:25:40.223000+00:00", "url": "https://www.cve.org/CVERecord?id=CVE-2023-54403" } } }
published 2026-09-30 20:47Z
last change 2026-10-21 07:05Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.