CVE-2023-54398
Received Received - Intake

Unauthenticated Java Deserialization in Yonyou U8 Cloud

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doAction method, which passes raw HTTP request body data directly to ObjectInputStream.readObject() without filtering, to achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2023-54398
EUVD
EUVD-2023-60691

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
yonyou u8_cloud *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2023-54398 is a Java deserialization vulnerability in Yonyou U8 Cloud's FileManageServlet component. It allows unauthenticated remote attackers to execute arbitrary OS commands by sending a malicious serialized payload via a POST request. The doAction method passes raw HTTP request data directly to ObjectInputStream.readObject() without validation, enabling remote code execution.

Detection Guidance

Detect this vulnerability by checking if your Yonyou U8 Cloud system is running vulnerable versions (U8CLOUD v1.0-v3.6 or U8CLOUD v3.6sp-v5.0). Monitor network traffic for POST requests to the path '/servlet/~uap/nc.impl.pub.filesystem.FileManageServlet' with serialized payloads. Use tools like ysoserial to generate test payloads and verify if the system is vulnerable.

Commands to check: 1) curl -X POST -d @payload.ser http://target/servlet/~uap/nc.impl.pub.filesystem.FileManageServlet 2) Use Wireshark to inspect HTTP POST requests to the vulnerable path.

Impact Analysis

This vulnerability allows attackers to remotely execute arbitrary commands on the server hosting Yonyou U8 Cloud. This could lead to full system compromise, data theft, unauthorized access, or disruption of services. Since no authentication is required, any exposed instance is at high risk of exploitation.

Compliance Impact

This vulnerability can severely impact compliance by enabling unauthorized access to sensitive data, potentially violating GDPR (data protection), HIPAA (health information), and other regulations. A successful exploit may result in data breaches, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately apply the official patch from Yonyou to fix the vulnerability. If patching is not immediately possible, restrict access to the vulnerable path '/servlet/~uap/nc.impl.pub.filesystem.FileManageServlet' via network firewall rules. Disable unauthenticated access to the doAction method in FileManageServlet.

Monitor network traffic for exploitation attempts and isolate affected systems if compromise is suspected. Update intrusion detection systems to detect Java deserialization attacks targeting this component.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2023-54398. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart