CVE-2025-12344: Yonyou U8 Cloud Request Header NCloudGatewayServlet unrestricted upload
A vulnerability has been found in Yonyou U8 Cloud up to 5.1sp. The impacted element is an unknown function of the file /service/NCloudGatewayServlet of the component Request Header Handler. Such manipulation of the argument ts/sign leads to unrestricted upload. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12344?
CVE-2025-12344 is considered a high severity vulnerability due to its potential for unrestricted file uploads.
How do I fix CVE-2025-12344?
To fix CVE-2025-12344, you should upgrade Yonyou U8 Cloud to a version beyond 5.1sp that addresses this vulnerability.
What component is affected by CVE-2025-12344?
CVE-2025-12344 affects the Request Header Handler component of Yonyou U8 Cloud.
What does CVE-2025-12344 allow an attacker to do?
CVE-2025-12344 allows an attacker to manipulate request parameters to achieve unrestricted file uploads.
Which versions of Yonyou U8 Cloud are impacted by CVE-2025-12344?
All versions of Yonyou U8 Cloud up to and including 5.1sp are impacted by CVE-2025-12344.