CVE-2023-33355
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
IceCMS v1.0.0 has insecure permissions, leading to unauthorized access to the API and disclosure of sensitive information.
Risk Assessment
The organization may be exposed to data leaks, which can lead to serious legal and reputational consequences.
Recommendation
It is recommended to review and improve access permissions to the API to protect sensitive information from unauthorized access.
Other vulnerabilities in IceCMS v1.0.0
See all- CVE-2023-36100Critical
An issue was discovered in IceCMS version 2.0.1, allowing attackers to escalate privileges and gain sensitive information via the UserID parameter in api/User/ChangeUser.
- CVE-2024-46607High
In IceCMS version 3.4.7 and earlier, an incorrect access control vulnerability exists in the loginAdmin method within UserController.java. Attackers can authenticate by entering arbitrary values as the username and password.
- CVE-2023-33356Medium
IceCMS version 1.0.0 is vulnerable to Cross Site Scripting (XSS) attacks, which may allow attackers to inject malicious code into the application.
Original NVD description (English source)
IceCMS v1.0.0 has Insecure Permissions. There is unauthorized access to the API, resulting in the disclosure of sensitive information.