Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the loginAdmin method in the UserController.java file.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:LThecosy Icecms
APPThecosy≤ 3.4.7
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Related vulnerabilities
CVE-2024-48202CRITICAL9.8PL ✓ten sam produkt
Nieograniczony upload plików w Thecosy IceCMS — RCE przez FileUtils.java
CVE-2024-46612CRITICAL9.8PL ✓ten sam produkt
IceCMS: zakodowany na stałe klucz JWT umożliwia fałszowanie tokenów
CVE-2023-40833CRITICAL9.8ten sam produkt
An issue in Thecosy IceCMS v.1.0.0 allows a remote attacker to gain privileges via the Id and key parameters i...
CVE-2025-22983HIGH7.5ten sam produkt
An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0 allows unauthenticated a...
CVE-2025-22984HIGH7.5ten sam produkt
An access control issue in the component /api/squareComment/DelectSquareById of iceCMS v2.2.0 allows unauthent...