What is CVE-2024-46607?

CVE-2024-46607 is a high-severity vulnerability in Thecosy Icecms, classified under Improper Access Control. CVSS score: 7.6/10. Published 2024-09-25.

How severe is CVE-2024-46607?

High severity. CVSS v3 base score is 7.6 out of 10.

Is CVE-2024-46607 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Thecosy Icecms

CVE-2024-46607

Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the loginAdmin method in the UserController.java file.

EPSS: 0.005 (38.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L.

Affected products

Thecosy Icecms
N/a — versions n/a

Weakness classification (CWE)

CWE-284 — Improper Access Control

Public proof-of-concept exploits

Lunax0/CVE_

References

cve@mitre.org (Product)
cve@mitre.org (Product)
cve@mitre.org (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2024-46607?: CVE-2024-46607 is a high-severity vulnerability in Thecosy Icecms, classified under Improper Access Control. CVSS score: 7.6/10. Published 2024-09-25.
How severe is CVE-2024-46607?: High severity. CVSS v3 base score is 7.6 out of 10.
Is CVE-2024-46607 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.