CVE-2023-4654
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In the GitHub repository instantsoft/icms2 prior to version 2.16.1, there is a vulnerability related to a sensitive cookie in an HTTPS session that lacks the 'Secure' attribute.
Risk Assessment
The absence of the 'Secure' attribute in cookies may allow attackers to intercept them, jeopardizing the confidentiality of user data.
Recommendation
It is recommended to upgrade to version 2.16.1 or later and ensure that all sensitive cookies have the 'Secure' attribute set.
Other vulnerabilities in instantsoft/icms2
See all- CVE-2023-4188Critical
There is a SQL Injection vulnerability in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git.
- CVE-2026-108568Medium
A vulnerability was determined in InstantSoft icms2 up to 2.18.2, affecting the validatePaypalOrder function in system/controllers/billing/actions/paypal.php of the Billing Module component. Manipulation of the bid/sig arguments leads to insufficient verification of data authenticity. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-108567Medium
A vulnerability was found in InstantSoft icms2 up to 2.18.2, impacting the files_delete_file function in system/fields/image.php of the Image Handler component. Manipulation of the size argument results in path traversal. The attack can be initiated remotely and the exploit is publicly available. The patch is named 03d70937f1ff97031523222808726994b8b79379.
- CVE-2023-4704Medium
In the GitHub repository instantsoft/icms2 prior to version 2.16.1-git, there is an external control of system or configuration settings.
- CVE-2023-4655Medium
The GitHub repository instantsoft/icms2 prior to version 2.16.1 has a reflected Cross-site Scripting (XSS) vulnerability.
- CVE-2023-4651Medium
There is a Server-Side Request Forgery (SSRF) vulnerability in the GitHub repository instantsoft/icms2 prior to version 2.16.1. This may lead to unauthorized access to internal server resources.
- CVE-2023-4649Medium
Session Fixation vulnerability in GitHub repository instantsoft/icms2 prior to version 2.16.1.
- CVE-2023-4189Medium
A Cross-site Scripting (XSS) vulnerability is reflected in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git.
- CVE-2023-4187Medium
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git, allowing attackers to inject malicious code into the application.
Original NVD description (English source)
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS