CVE-2023-4704
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
In the GitHub repository instantsoft/icms2 prior to version 2.16.1-git, there is an external control of system or configuration settings.
Risk Assessment
An attacker could manipulate system settings, potentially leading to unauthorized access or changes to the application's configuration.
Recommendation
It is recommended to upgrade to version 2.16.1-git or later to mitigate the risks associated with this vulnerability.
Other vulnerabilities in instantsoft/icms2
See all- CVE-2023-4188Critical
There is a SQL Injection vulnerability in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git.
- CVE-2023-4655Medium
The GitHub repository instantsoft/icms2 prior to version 2.16.1 has a reflected Cross-site Scripting (XSS) vulnerability.
- CVE-2023-4654Low
In the GitHub repository instantsoft/icms2 prior to version 2.16.1, there is a vulnerability related to a sensitive cookie in an HTTPS session that lacks the 'Secure' attribute.
- CVE-2023-4651Medium
There is a Server-Side Request Forgery (SSRF) vulnerability in the GitHub repository instantsoft/icms2 prior to version 2.16.1. This may lead to unauthorized access to internal server resources.
- CVE-2023-4649Medium
Session Fixation vulnerability in GitHub repository instantsoft/icms2 prior to version 2.16.1.
- CVE-2023-4189Medium
A Cross-site Scripting (XSS) vulnerability is reflected in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git.
- CVE-2023-4187Medium
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git, allowing attackers to inject malicious code into the application.
Original NVD description (English source)
External Control of System or Configuration Setting in GitHub repository instantsoft/icms2 prior to 2.16.1-git.