CVE-2023-4649
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Session Fixation vulnerability in GitHub repository instantsoft/icms2 prior to version 2.16.1.
Risk Assessment
An attacker could hijack a user's session, leading to unauthorized access to application data and functions.
Recommendation
It is recommended to upgrade to version 2.16.1 or later to mitigate this vulnerability.
Other vulnerabilities in instantsoft/icms2
See all- CVE-2023-4188Critical
There is a SQL Injection vulnerability in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git.
- CVE-2023-4704Medium
In the GitHub repository instantsoft/icms2 prior to version 2.16.1-git, there is an external control of system or configuration settings.
- CVE-2023-4655Medium
The GitHub repository instantsoft/icms2 prior to version 2.16.1 has a reflected Cross-site Scripting (XSS) vulnerability.
- CVE-2023-4654Low
In the GitHub repository instantsoft/icms2 prior to version 2.16.1, there is a vulnerability related to a sensitive cookie in an HTTPS session that lacks the 'Secure' attribute.
- CVE-2023-4651Medium
There is a Server-Side Request Forgery (SSRF) vulnerability in the GitHub repository instantsoft/icms2 prior to version 2.16.1. This may lead to unauthorized access to internal server resources.
- CVE-2023-4189Medium
A Cross-site Scripting (XSS) vulnerability is reflected in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git.
- CVE-2023-4187Medium
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git, allowing attackers to inject malicious code into the application.
Original NVD description (English source)
Session Fixation in GitHub repository instantsoft/icms2 prior to 2.16.1.