CVE-2023-51926 is a high severity arbitrary file read in Yonyou YonBIP v3_23.05, scored 7.5. A remote attacker can read files from the server through the CommonServletDispatcher. A distinct fixed build is not confirmed, so ask Yonyou for the patch and restrict access.
What's affected
CVE-2023-51926 affects YonBIP v3_23.05 from Yonyou. NVD published it on 2024-01-20 with a score of 7.5 (high) and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The impact is confidentiality only: no integrity or availability impact is scored.
NVD says the flaw is an arbitrary file read via the nc.bs.framework.comn.serv.CommonServletDispatcher component. The reporter notes add that the dispatcher calls public methods on a named class, and that the getServerFileContent method of nc.login.bs.INCLoginService reads a file at a path the caller supplies.
The reporter's notes list the fixed version as YonBIP v3_23.05 (patched). That is the same label as the affected version, so it does not tell you which build contains the fix. Treat the fix status as unconfirmed and ask Yonyou for the exact patched build.
Sibling CVEs against the same release: CVE-2023-51906, CVE-2023-51924, CVE-2023-51925, CVE-2023-51927, CVE-2023-51928. Several of them are more severe, so this one should not be patched in isolation.
NVD lists no CWE for this record, so the weakness class below comes from the description and the reporter notes.
How to check if you're exposed
Start with inventory. Find out whether you run YonBIP, and which release. The record names version 3_23.05, so any instance reporting that release is in scope until Yonyou says otherwise. Your vendor or integrator can tell you the build string from the product's admin or about page, because this is a commercial enterprise suite and I could not confirm a command-line check from the advisory.
Then check exposure. Most of the damage in this family comes from reaching the servlet endpoint over the network without logging in, so list every host that serves YonBIP and note whether it is reachable from the internet or only from an internal network. Your reverse proxy or load balancer logs show which paths receive traffic from outside.
If a web application firewall sits in front, review its logs for unexpected requests to the servlet path named in the advisory, and for new or modified files in the application's web directories. Unexpected files in those directories are the clearest sign that an upload flaw was used.
What to do now
- Confirm whether you run YonBIP v3_23.05 and record every instance, including test and staging copies.
- Contact Yonyou or your integrator and ask for the patched build and release notes for this CVE. Do not assume the label patched in the reporter notes means your build is fixed.
- Remove internet exposure. Put the application behind a VPN or an allow list of known source addresses until the patch is confirmed.
- Review web server and application logs since the product went live for requests to the affected component, and check web directories for files you did not deploy.
- If you find unexpected files, treat the host as compromised: isolate it, preserve logs, rotate credentials the application could read, and rebuild from a known good image.
Why it matters
The weakness is missing access control on a method that reads files. A file read score of 7.5 can understate the practical risk, because configuration files on a server often contain database credentials and keys. If an attacker reads those, the next step is usually a login rather than an exploit, and it leaves less noise in the logs.
For that reason, if you find evidence of access to this component, rotate any credentials stored in files the application account can read, not just passwords for the application itself. The record's KEV flag is false and I found no advisory that reports exploitation.
Quick check
Why rotate secrets for a read only bug?
Because files the app can read often include connection strings and keys. A read flaw can hand those over, and rotating them closes that second step.
Is a fix available?
The reporter notes say patched without a distinct build number. Ask Yonyou which release contains the fix.
Sources
Reporter notes for CVE-2023-51926 on GitHub (fetched, third party, not a vendor advisory)
NVD record for CVE-2023-51926 (the record this guide is built from)
Yonyou website (listed in the record; no advisory found there)
Last reviewed: 19 October 2026.
