CVE-2024-46609

Published: Sep 25, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unauthenticated attackers to access and returns all user information, including passwords

Affected (1)

Products: Thecosy: Icecms

Thecosy

1 product

Icecms

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Thecosy Icecms	Up to 3.4.7

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (2)

https://github.com/Lunax0/LogLunax/blob/main/icecms/CVE-2024-46609.md

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/Thecosy/iceCMS?tab=readme-ov-file

Source: cve@mitre.org

ExploitThird Party Advisory

Timeline

No history available yet.