External risk intelligence

YzmCMS v6.3 Unauthorized Access to User Home Pages

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2022-23383

YzmCMS is a Content Management System designed to be deployed as a public-facing web application. Since the vulnerability allows unauthorized access to personal home pages on the site, it involves components that are typically reachable by the public internet in standard deployments of such web platforms.

Authentication Bypass

Yzmcms

6.3

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE describes a critical security flaw in YzmCMS version 6.3, specifically a broken access control issue that allows unauthorized users to access personal home pages without logging in. This could enable access to other users' information due to insufficient authentication.

Allows access to user pages without logging in.
Affects public-facing websites that use this software.
Confirm if this software is used and check relevant exposure.

Attack Path

How an attacker could exploit the issue

An attacker can bypass login requirements to access personal home pages on a YzmCMS v6.3 site, potentially viewing or altering sensitive user information. This is possible because the system fails to properly verify if a user is logged in before granting access to their private pages.

No login required for access.
Access other users' home pages.
Unauthorized information exposure and modification.

Live Threat

Current exploitation, exposure, and threat context

When not logged in, an attacker could access other users' personal home pages on YzmCMS v6.3 due to improper authentication. This could lead to the exposure of sensitive information displayed on these pages.

User personal home pages.
Unauthorized access to user data.
Exposure of user information.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in YzmCMS, affecting systems with public web access, requires immediate attention from application owners and security teams. The first practical step is to identify all instances of YzmCMS v6.3, confirm their reachability and business criticality, and then locate the accountable owner to prioritize remediation efforts.

Application owners must confirm affected assets.
Verify public exposure and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is YzmCMS?

YzmCMS is a content management system used to build and maintain websites. It provides a platform for managing web content and user accounts. Version 6.3 is specifically affected by this vulnerability.

What is the vulnerability in CVE-2022-23383?

This CVE involves a broken access control weakness (CWE-287). Essentially, the software fails to properly verify if a user is logged in before allowing them to view personal home pages. Because the system does not perform real authentication, it incorrectly permits access to private user information without a valid session.

How can an attacker trigger this flaw?

An attacker can trigger this by attempting to navigate directly to a user's personal home page URL without having performed a login. The bug exists specifically because the application does not validate the login status during this request. If a user is already authenticated, the vulnerability does not manifest in the same way, as the system already recognizes them; the risk is strictly tied to unauthenticated requests.

Do I need to worry if my site is not public?

Halo Surface Signal notes that YzmCMS is typically deployed as a public-facing web application, meaning most instances are reachable from the internet. If your specific instance is hosted on an internal network, the risk of unauthorized external access is significantly lower, though it remains a local security concern if untrusted internal users could reach the site.

What should I do if I run YzmCMS v6.3?

Your first step is to confirm if your environment is running the affected version, 6.3. Once identified, locate the owner of the application to assess how the site is deployed and its business criticality. Prioritize determining if the software is exposed to the internet and coordinate with your team to plan for updates or necessary configuration changes to enforce proper authentication.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.