Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The skin-management feature in tianti 2.3 allows remote authenticated users to bypass intended permission restrictions by visiting tianti-module-admin/user/skin/list directly because controller\usercontroller.java maps a /skin/list request to the function skinList, and lacks an authorization check.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
tianti 访问控制错误漏洞
Vulnerability Description
tianti是一套使用Java语言编写的轻量级内容管理系统（CMS）。 tianti 2.3版本中的skin-management功能存在安全漏洞。远程攻击者可通过直接访问tianti-module-admin/user/skin/list页面利用该漏洞绕过既定的访问限制。
CVSS Information
N/A
Vulnerability Type
N/A