CVE-2023-4650 Improper Access Control in instantsoft/icms2
Attackers can bypass access controls in InstantCMS to perform unauthorized actions due to improper authorization checks.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4650?
CVE-2023-4650 is a medium-severity missing authorization vulnerability in instantsoft/icms2, published on 31 Aug 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Improper Access Control in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
Weakness: CWE-284
Which versions are affected by CVE-2023-4650?
It affects 1 product.
Products include Instantcms Instantcms.
How do I fix CVE-2023-4650?
No fix has been published for CVE-2023-4650 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-4650 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-4650 exists.
Other vulnerabilities in instantsoft/icms2
- CVE-2023-4188 SQL Injection in instantsoft/icms2
- CVE-2013-10051 InstantCMS <= 1.6 Remote PHP Code Execution
- CVE-2023-4704 External Control of System or Configuration Setting in instantsoft/icms2
- CVE-2026-28281 InstantCMS has Multiple CSRF Vulnerabilities
- CVE-2023-4652 Cross-site Scripting (XSS) - Stored in instantsoft/icms2
Sources
Also known as GHSA-vp69-r7gq-xp5p.