CVE-2024-46607 Auth bypass in n/a
Attackers can bypass authentication in IceCMS by entering arbitrary credentials, gaining unauthorized administrative access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-46607?
CVE-2024-46607 is a high-severity authentication bypass vulnerability in n/a, published on 24 Sep 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the loginAdmin method in the UserController.java file.
Weakness: CWE-284
Which versions are affected by CVE-2024-46607?
It affects 1 product.
Products include Thecosy Icecms.
How do I fix CVE-2024-46607?
No fix has been published for CVE-2024-46607 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-46607 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-46607 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-rm3j-jj6h-qrq4.