CVE-2024-46607

Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the…

High · published September 24, 2024

CVSS v3.1
7.6
EPSS
1%
Percentile
43.2
In the wild
Unconfirmed
What it is

Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the loginAdmin method in the UserController.java file.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00517 · 43.2th percentile
Published
2024-09-24T00:00Z
EPSS history
Timeline
  • 24 SEP 00:00Z
    Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the…
    cvelistv5