CVE-2023-49383: 
Java vulnerability analysis and mitigation

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save. The vulnerability was assigned CVE-2023-49383 and was disclosed on December 5, 2023. The vulnerability affects JFinalCMS version 5.0.0 (NVD).

The vulnerability is classified as a Cross-Site Request Forgery (CSRF) weakness (CWE-352) that affects the tag management functionality in JFinalCMS. The vulnerability exists in the /admin/tag/save component. The CVSS v3.1 base score is 8.8 HIGH with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

A successful exploitation of this CSRF vulnerability could allow attackers to perform unauthorized actions in the context of an authenticated user's session. Given the CVSS metrics, the vulnerability can lead to high impacts on confidentiality, integrity, and availability of the system when successfully exploited (NVD).

The vulnerability requires user interaction (UI:R) but no privileges (PR:N) and can be exploited from the network (AV:N) with low attack complexity (AC:L). An exploit has been publicly documented (GitHub POC).