PT-2023-27661 · Thecosy · Thecosy Icecms

Sholway · Published 2023-10-12 · Updated 2023-12-07 · CVE-2023-40833

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Thecosy IceCMS version 1.0.0

Description The issue allows a remote attacker to gain privileges. This is achieved via the Id and key parameters in the getCosSetting function.

Recommendations For Thecosy IceCMS version 1.0.0, consider restricting access to the getCosSetting function until a patch is available. Avoid using the Id and key parameters in this function to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2023-40833

Affected Products

Thecosy Icecms

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2023-40833 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40833 · Vendor Advisory
• https://gist.github.com/Sholway/93f05987dbf35c15c26de32b1e5590ec · Note