High severity · published Sep 24, 2024
CVE-2024-46609
An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unauthenticated attackers to access and returns all user information,…
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unauthenticated attackers to access and returns all user information, including passwords
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
Icecms · Thecosy
through 3.4.7 · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-46609
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-46609
Exploit
https://github.com/Lunax0/LogLunax/blob/main/icecms/CVE-2024-46609.md
Exploit
https://github.com/Thecosy/iceCMS?tab=readme-ov-file
More from Icecms
9.8
CVE-2026-111673
IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints
9.8
CVE-2024-48202
icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile
9.8
CVE-2024-46612
IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information
9.8
CVE-2023-6756
Thecosy IceCMS Captcha login excessive authentication
9.8
CVE-2023-40833
An issue in Thecosy IceCMS v.1.0.0 allows a remote attacker to gain privileges via the Id and key parameters in getCosSetting