PT-2023-27661 · Thecosy · Thecosy Icecms

Sholway · Publicado 2023-10-12 · Atualizado 2023-12-07 · CVE-2023-40833

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Thecosy IceCMS version 1.0.0

Description The issue allows a remote attacker to gain privileges. This is achieved via the Id and key parameters in the getCosSetting function.

Recommendations For Thecosy IceCMS version 1.0.0, consider restricting access to the getCosSetting function until a patch is available. Avoid using the Id and key parameters in this function to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2023-40833

Produtos afetados

Thecosy Icecms

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2023-40833 · Nota de Segurança
• https://gist.github.com/Sholway/93f05987dbf35c15c26de32b1e5590ec · Nota
• https://osv.dev/vulnerability/CVE-2023-40833 · Aviso do Fabricante