Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the loginAdmin method in the UserController.java file.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| http://icecms.com | Product |
| https://github.com/Lunax0/LogLunax/blob/main/icecms/CVE-2024-46607.md | Exploit Third Party Advisory |
| https://github.com/Thecosy/iceCMS?tab=readme-ov-file | Product |
Configurations
History
28 Apr 2025, 17:09
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:thecosy:icecms:*:*:*:*:*:*:*:* | |
| References | () https://github.com/Lunax0/LogLunax/blob/main/icecms/CVE-2024-46607.md - Exploit, Third Party Advisory | |
| References | () https://github.com/Thecosy/iceCMS?tab=readme-ov-file - Product | |
| References | () http://icecms.com - Product | |
| CWE | NVD-CWE-noinfo | |
| First Time |
Thecosy
Thecosy icecms |
25 Sep 2024, 01:36
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-09-25 01:15
Updated : 2025-04-28 17:09
NVD link : CVE-2024-46607
Mitre link : CVE-2024-46607
JSON object : View
Products Affected
thecosy
- icecms
CWE