Security readout for executives and security teams
Plain-English summary
CVE-2023-51927 is a critical SQL injection reported in YonBIP v3_23.05. The flaw is tied to an attendance script controller method and is rated 9.8 CVSS, meaning remote unauthenticated impact is possible according to the record. The public data does not name a patch, fixed version, or confirmed exploitation.
Executive priority
Prioritize rapid exposure assessment. The rating is critical, but urgency depends on whether YonBIP v3_23.05 is deployed and reachable. Do not assume patch status from the current public data.
Technical view
The CVE describes CWE-89 SQL injection in com.yonyou.hrcloud.attend.web.AttendScriptController.runScript() in YonBIP v3_23.05. CVSS 3.1 is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Affected vendor/product/CPE metadata is incomplete in the supplied record, despite the title identifying YonBIP.
Likely exposure
Organizations should assess exposure only if they run YonBIP v3_23.05 or related Yonyou HR cloud attendance components. Internet-facing deployments would be higher concern because the CVSS vector indicates network reachability and no authentication requirement.
Exploitation context
The source bundle does not show CISA KEV listing or any cited confirmation of active exploitation. A GitHub reference is listed by the CVE record, but the supplied bundle does not provide verified exploit status or remediation details.
Researcher notes
Evidence is limited. The CVE names a specific Java controller method and SQL injection class, but affected-product metadata is incomplete and no official fix is included in the supplied sources. Avoid broad claims about all Yonyou products.
Mitigation direction
- Check Yonyou guidance for an official patch, workaround, or fixed release.
- Restrict external access to YonBIP attendance or HR cloud interfaces.
- Apply vendor updates if a fixed version is available for your deployment.
- Review database account privileges used by the application.
- Increase monitoring for SQL errors and unusual attendance-controller activity.
Validation and detection
- Inventory YonBIP versions and confirm whether v3_23.05 is present.
- Identify exposed Yonyou HR cloud attendance interfaces in internal and external attack surface records.
- Review application logs for requests hitting attendance script controller functionality.
- Check database logs for unusual errors, failed queries, or unexpected data access.
- Confirm whether compensating controls block unauthenticated access to affected functionality.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2023-51927 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.yonyou.com/CVE reference, mitre
- https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about/51927.txtCVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.