CVE-2024-46607
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
In IceCMS version 3.4.7 and earlier, an incorrect access control vulnerability exists in the loginAdmin method within UserController.java. Attackers can authenticate by entering arbitrary values as the username and password.
Risk Assessment
An attacker can gain unauthorized access to the admin panel, leading to full compromise of the CMS system and potential data theft or site takeover.
Recommendation
Immediately upgrade IceCMS to a version later than 3.4.7 where this vulnerability is fixed. If an upgrade is not possible, temporarily disable access to the loginAdmin method or implement additional authentication mechanisms.
Other vulnerabilities in IceCMS
See all- CVE-2023-36100Critical
An issue was discovered in IceCMS version 2.0.1, allowing attackers to escalate privileges and gain sensitive information via the UserID parameter in api/User/ChangeUser.
- CVE-2023-33356Medium
IceCMS version 1.0.0 is vulnerable to Cross Site Scripting (XSS) attacks, which may allow attackers to inject malicious code into the application.
- CVE-2023-33355High
IceCMS v1.0.0 has insecure permissions, leading to unauthorized access to the API and disclosure of sensitive information.
Original NVD description (English source)
Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the loginAdmin method in the UserController.java file.