CVE-2023-36100 Privilege escalation in n/a
Attackers can escalate privileges and access sensitive information via the UserID parameter in the ChangeUser API endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-36100?
CVE-2023-36100 is a critical vulnerability in n/a, published on 1 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in IceCMS version 2.0.1, allows attackers to escalate privileges and gain sensitive information via UserID parameter in api/User/ChangeUser.
Weakness: CWE-269
Which versions are affected by CVE-2023-36100?
It affects 1 product.
Products include Macwk Icecms.
How do I fix CVE-2023-36100?
No fix has been published for CVE-2023-36100 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-36100 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-36100 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-4g5h-7prv-mvj5.