CVE-2023-6762 Thecosy IceCMS Article permission
Remote attackers can delete articles in Thecosy IceCMS due to missing authorization checks in the article handler.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-6762?
CVE-2023-6762 is a medium-severity missing authorization vulnerability in Thecosy IceCMS, published on 13 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability, which was classified as critical, was found in Thecosy IceCMS 2.0.1. Affected is an unknown function of the file /article/DelectArticleById/ of the component Article Handler. The manipulation leads to permission issues. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-247890 is the identifier assigned to this vulnerability.
Weakness: CWE-275
Which versions are affected by CVE-2023-6762?
It affects 1 product.
Products include Thecosy Icecms.
How do I fix CVE-2023-6762?
No fix has been published for CVE-2023-6762 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-6762 being exploited?
There is no known exploitation of CVE-2023-6762 in the wild and no public exploit code.
Other vulnerabilities in Thecosy IceCMS
Sources
Also known as GHSA-w76m-mfcx-2wg8.