PT-2023-32680 · Thecosy · Thecosy Icecms

Zero121 · Published 2023-12-02 · Updated 2024-05-17 · CVE-2023-6467

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Thecosy IceCMS version 2.0.1

Description A vulnerability was found in the Comment Like Handler component, affecting the processing of the file /Websquare/likeClickComment/. This issue leads to improper enforcement of a single, unique action and can be initiated remotely. The complexity of an attack is rather high, and the exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.

Recommendations For Thecosy IceCMS version 2.0.1, consider disabling the Comment Like Handler component or restricting access to the /Websquare/likeClickComment/ file until a patch is available. As a temporary workaround, avoid using the affected component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-837

Related Identifiers

CVE-2023-6467

Affected Products

Thecosy Icecms

References · 6

• 🔥 http://39.106.130.187/wenjian/2.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-6467 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6467 · Vendor Advisory
• https://vuldb.com/?ctiid.246617 · Note
• https://vuldb.com/?id.246617 · Note
• https://t.me/cvenotify/61993 · Telegram Post