CVE-2023-51928 is a critical arbitrary file upload flaw in Yonyou YonBIP v3_23.05, scored 9.8. A remote attacker can upload a crafted file and run code. The record and the reporter notes name different components, so ask Yonyou for the patch and limit access.
What's affected
CVE-2023-51928 affects YonBIP v3_23.05 from Yonyou. NVD published it on 2024-01-20 with a score of 9.8 (critical) and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. NVD describes an arbitrary file upload in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method that allows code execution through a crafted file.
The reporter's notes list the fixed version as YonBIP v3_23.05 (patched). That is the same label as the affected version, so it does not tell you which build contains the fix. Treat the fix status as unconfirmed and ask Yonyou for the exact patched build.
This is a source conflict. The NVD description is word for word the same as CVE-2023-51925. The reporter notes for this ID instead describe the nc.itf.uap.sf.ICustomMenuService interface, where the insertIcon method saves the data in the icon attribute of the customMenuIcon parameter to the path held in cIconID, reached through CommonServletDispatcher. The impact class is the same. Plan for both components until Yonyou clarifies.
Five sibling CVEs were published against the same release on the same day: CVE-2023-51906, CVE-2023-51924, CVE-2023-51925, CVE-2023-51926, CVE-2023-51927. They are separate weaknesses in different components, so fixing one does not close the others. Ask for a patch that covers all six.
Weakness class: CWE-434.
How to check if you're exposed
Start with inventory. Find out whether you run YonBIP, and which release. The record names version 3_23.05, so any instance reporting that release is in scope until Yonyou says otherwise. Your vendor or integrator can tell you the build string from the product's admin or about page, because this is a commercial enterprise suite and I could not confirm a command-line check from the advisory.
Then check exposure. Most of the damage in this family comes from reaching the servlet endpoint over the network without logging in, so list every host that serves YonBIP and note whether it is reachable from the internet or only from an internal network. Your reverse proxy or load balancer logs show which paths receive traffic from outside.
If a web application firewall sits in front, review its logs for unexpected requests to the servlet path named in the advisory, and for new or modified files in the application's web directories. Unexpected files in those directories are the clearest sign that an upload flaw was used.
What to do now
- Confirm whether you run YonBIP v3_23.05 and record every instance, including test and staging copies.
- Contact Yonyou or your integrator and ask for the patched build and release notes for this CVE. Do not assume the label patched in the reporter notes means your build is fixed.
- Remove internet exposure. Put the application behind a VPN or an allow list of known source addresses until the patch is confirmed.
- Review web server and application logs since the product went live for requests to the affected component, and check web directories for files you did not deploy.
- If you find unexpected files, treat the host as compromised: isolate it, preserve logs, rotate credentials the application could read, and rebuild from a known good image.
Why it matters
Whichever component is correct, the class is CWE-434: content and a destination path come from the request and are written to disk without checks. The reporter notes show the dispatcher exposing public methods of named classes, which is why several unrelated features such as a menu icon setter end up able to write files.
Unauthenticated, network reachable flaws in enterprise business software are attractive because the product often holds finance, HR and supply chain data. The record's KEV flag is false, and I found no advisory stating exploitation in the wild, so this is a patch and exposure problem rather than a known active campaign.
Quick check
Which component should I worry about?
Both. NVD names ArcpUploadAction and the reporter notes name ICustomMenuService.insertIcon. Ask the vendor to confirm what its patch changes.
Why would an icon setting method be risky?
Because it writes data to a path taken from the request. Any method that does that without validating path and content can place a file where the server may run it.
Sources
Reporter notes for CVE-2023-51928 on GitHub (fetched, third party, not a vendor advisory)
NVD record for CVE-2023-51928 (the record this guide is built from)
Yonyou website (listed in the record; no advisory found there)
Last reviewed: 19 October 2026.
