CVE-2023-33356
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
IceCMS version 1.0.0 is vulnerable to Cross Site Scripting (XSS) attacks, which may allow attackers to inject malicious code into the application.
Risk Assessment
Exploitation of this vulnerability could lead to user data theft and session hijacking, posing a serious threat to application security.
Recommendation
It is recommended to update IceCMS to the latest version to mitigate this vulnerability and implement appropriate protections against XSS attacks.
Other vulnerabilities in IceCMS v1.0.0
See all- CVE-2023-36100Critical
An issue was discovered in IceCMS version 2.0.1, allowing attackers to escalate privileges and gain sensitive information via the UserID parameter in api/User/ChangeUser.
- CVE-2024-46607High
In IceCMS version 3.4.7 and earlier, an incorrect access control vulnerability exists in the loginAdmin method within UserController.java. Attackers can authenticate by entering arbitrary values as the username and password.
- CVE-2023-33355High
IceCMS v1.0.0 has insecure permissions, leading to unauthorized access to the API and disclosure of sensitive information.
Original NVD description (English source)
IceCMS v1.0.0 is vulnerable to Cross Site Scripting (XSS).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS