CVE-2024-46612: Critical severity icecms vulnerability
Published Sep 24, 2024
·Updated
IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information.
Affected Software
2 affected components
iceCMS iceCMS<3.4.7
Thecosy IceCMS<3.4.7
Event History
Sep 24, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Sep 25, 2024
Data Sourced
via NVD·01:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-46612?
CVE-2024-46612 has been classified as a high severity vulnerability due to the potential for authentication forgery.
2
How do I fix CVE-2024-46612?
To mitigate CVE-2024-46612, update IceCMS to version 3.4.8 or later, which removes the hardcoded JWT key.
3
What damages can CVE-2024-46612 cause?
CVE-2024-46612 can allow attackers to bypass authentication mechanisms, potentially leading to unauthorized access to sensitive data.
4
Which versions of IceCMS are affected by CVE-2024-46612?
CVE-2024-46612 affects IceCMS versions 3.4.7 and earlier.
5
Is there a workaround for CVE-2024-46612 if I cannot upgrade?
If upgrading is not possible, consider implementing additional security measures, such as strict API access controls, until the application can be updated.