High severity · published Sep 24, 2024
CVE-2024-46607
Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the loginAdmin method in…
7.6
CVSS
0.5%
EPSS
No
On KEV
Description
Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the loginAdmin method in the UserController.java file.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
Icecms · Thecosy
through 3.4.7 · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-46607
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-46607
Exploit
https://github.com/Lunax0/LogLunax/blob/main/icecms/CVE-2024-46607.md
Product
https://github.com/Thecosy/iceCMS?tab=readme-ov-file
More from Icecms
9.8
CVE-2026-111673
IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints
9.8
CVE-2024-48202
icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile
9.8
CVE-2024-46612
IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information
9.8
CVE-2023-6756
Thecosy IceCMS Captcha login excessive authentication
9.8
CVE-2023-40833
An issue in Thecosy IceCMS v.1.0.0 allows a remote attacker to gain privileges via the Id and key parameters in getCosSetting