CVE-2024-46607

HIGH

7.6

Descripcion

Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the loginAdmin method in the UserController.java file.

Detalles CVE

Puntuacion CVSS v3.17.6

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioREQUIRED

Publicado9/25/2024

Ultima modificacion4/28/2025

Fuentenvd

Avistamientos honeypot0

Productos afectados

thecosy:icecms

Debilidades (CWE)

CWE-284

Referencias

http://icecms.com(cve@mitre.org)

https://github.com/Lunax0/LogLunax/blob/main/icecms/CVE-2024-46607.md(cve@mitre.org)

https://github.com/Thecosy/iceCMS?tab=readme-ov-file(cve@mitre.org)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.