CVE-2024-46609: High severity icecms vulnerability
Published Sep 24, 2024
·Updated
An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unauthenticated attackers to access and returns all user information, including passwords
Affected Software
2 affected components
iceCMS iceCMS<3.4.7
Thecosy IceCMS<=3.4.7
Event History
Sep 24, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Sep 25, 2024
Data Sourced
via NVD·01:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-46609?
CVE-2024-46609 has been rated as a high severity vulnerability due to its ability to allow unauthenticated attackers to access sensitive user information.
2
How do I fix CVE-2024-46609?
To fix CVE-2024-46609, upgrade IceCMS to version 3.4.8 or later, where the access control issue has been addressed.
3
Who is affected by CVE-2024-46609?
CVE-2024-46609 affects all installations of IceCMS version 3.4.7 and earlier.
4
What type of vulnerability is CVE-2024-46609?
CVE-2024-46609 is classified as an access control vulnerability that exposes user data.
5
What information can be accessed due to CVE-2024-46609?
CVE-2024-46609 allows attackers to access all user information, including passwords.