CVE-2023-36100
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
An issue was discovered in IceCMS version 2.0.1, allowing attackers to escalate privileges and gain sensitive information via the UserID parameter in api/User/ChangeUser.
Risk Assessment
Privilege escalation may lead to unauthorized access to user data, posing a serious security threat to the organization.
Recommendation
It is recommended to update IceCMS to the latest version and monitor logs for potential attack attempts.
Other vulnerabilities in IceCMS 2.0.1
See all- CVE-2024-46607High
In IceCMS version 3.4.7 and earlier, an incorrect access control vulnerability exists in the loginAdmin method within UserController.java. Attackers can authenticate by entering arbitrary values as the username and password.
- CVE-2023-33356Medium
IceCMS version 1.0.0 is vulnerable to Cross Site Scripting (XSS) attacks, which may allow attackers to inject malicious code into the application.
- CVE-2023-33355High
IceCMS v1.0.0 has insecure permissions, leading to unauthorized access to the API and disclosure of sensitive information.
Original NVD description (English source)
An issue was discovered in IceCMS version 2.0.1, allows attackers to escalate privileges and gain sensitive information via UserID parameter in api/User/ChangeUser.