CVE-2023-51906 is a critical flaw in Yonyou YonBIP v3_23.05, scored 9.8 by NVD, that lets a remote attacker run code through the ServiceDispatcherServlet. The vendor has not published a clear fixed build in anything I could confirm, so ask Yonyou for the patch and keep the application off the internet.
What's affected
CVE-2023-51906 affects YonBIP v3_23.05 from Yonyou. NVD published it on 2024-01-20 with a score of 9.8 (critical) and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. NVD describes remote code execution through a crafted script sent to the ServiceDispatcherServlet and its uap.framework.rc.itf.IResourceManager component.
The reporter's notes list the fixed version as YonBIP v3_23.05 (patched). That is the same label as the affected version, so it does not tell you which build contains the fix. Treat the fix status as unconfirmed and ask Yonyou for the exact patched build.
The record and the reporter notes describe this differently. The NVD text points at the IResourceManager component and code execution. The reporter notes for this ID describe an arbitrary file upload in the nc.itf.iufo.IBaseSPService interface, in a method that saves a request string to a path the caller chooses, reached through CommonServletDispatcher. Both agree on the impact class: an attacker who can write files or run code on the server. Use the higher impact when you plan.
Five sibling CVEs were published against the same release on the same day: CVE-2023-51924, CVE-2023-51925, CVE-2023-51926, CVE-2023-51927, CVE-2023-51928. They are separate weaknesses in different components, so fixing one does not close the others. Ask for a patch that covers all six.
NVD lists no CWE for this record, so the weakness class below comes from the description and the reporter notes.
How to check if you're exposed
Start with inventory. Find out whether you run YonBIP, and which release. The record names version 3_23.05, so any instance reporting that release is in scope until Yonyou says otherwise. Your vendor or integrator can tell you the build string from the product's admin or about page, because this is a commercial enterprise suite and I could not confirm a command-line check from the advisory.
Then check exposure. Most of the damage in this family comes from reaching the servlet endpoint over the network without logging in, so list every host that serves YonBIP and note whether it is reachable from the internet or only from an internal network. Your reverse proxy or load balancer logs show which paths receive traffic from outside.
If a web application firewall sits in front, review its logs for unexpected requests to the servlet path named in the advisory, and for new or modified files in the application's web directories. Unexpected files in those directories are the clearest sign that an upload flaw was used.
What to do now
- Confirm whether you run YonBIP v3_23.05 and record every instance, including test and staging copies.
- Contact Yonyou or your integrator and ask for the patched build and release notes for this CVE. Do not assume the label patched in the reporter notes means your build is fixed.
- Remove internet exposure. Put the application behind a VPN or an allow list of known source addresses until the patch is confirmed.
- Review web server and application logs since the product went live for requests to the affected component, and check web directories for files you did not deploy.
- If you find unexpected files, treat the host as compromised: isolate it, preserve logs, rotate credentials the application could read, and rebuild from a known good image.
Why it matters
The reporter notes explain the pattern. The doPost method of the CommonServletDispatcher class will call a public method on a named class object. When a dispatcher exposes methods like that without checking who is calling, any method on the exposed interface becomes reachable from the network. A method that writes a caller supplied string to a caller supplied path then becomes an arbitrary file write, and a file write into a web directory becomes code execution.
Unauthenticated, network reachable flaws in enterprise business software are attractive because the product often holds finance, HR and supply chain data. The record's KEV flag is false, and I found no advisory stating exploitation in the wild, so this is a patch and exposure problem rather than a known active campaign.
Quick check
Is CVE-2023-51906 exploited in the wild?
The record's KEV flag is false and none of the sources I read says it has been exploited. That can change, so check the CISA Known Exploited Vulnerabilities catalog before you rank this.
Why do the record and the reporter notes name different components?
NVD summarises the CVE as code execution via IResourceManager. The reporter notes describe a file upload method on a different interface. Treat both as the same product weakness class and ask the vendor which components the patch changes.
Sources
Reporter notes for CVE-2023-51906 on GitHub (fetched, third party, not a vendor advisory)
NVD record for CVE-2023-51906 (the record this guide is built from)
Yonyou website (listed in the record; no advisory found there)
Last reviewed: 19 October 2026.
