CVE-2023-6761

A vulnerability, which was classified as problematic, has been found in Thecosy IceCMS up to 2.0.1. This issue affects some unknown processing of the component User Data Handler. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247889 was assigned to this vulnerability.

CVSS v3 4.3 MEDIUM
CVSS v2.0 4.0 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://39.106.130.187/chui/1.html	Exploit Third Party Advisory
https://vuldb.com/?ctiid.247889	Permissions Required Third Party Advisory
https://vuldb.com/?id.247889	Third Party Advisory
http://39.106.130.187/chui/1.html	Exploit Third Party Advisory
https://vuldb.com/?ctiid.247889	Permissions Required Third Party Advisory
https://vuldb.com/?id.247889	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:thecosy:icecms:2.0.1:*:*:*:*:*:*:*

History

21 Nov 2024, 08:44

Type	Values Removed	Values Added
CVSS	v2 : ~~4.0~~ v3 : ~~8.8~~	v2 : 4.0 v3 : 4.3
References	~~() http://39.106.130.187/chui/1.html - Exploit, Third Party Advisory~~	() http://39.106.130.187/chui/1.html - Exploit, Third Party Advisory
References	~~() https://vuldb.com/?ctiid.247889 - Permissions Required, Third Party Advisory~~	() https://vuldb.com/?ctiid.247889 - Permissions Required, Third Party Advisory
References	~~() https://vuldb.com/?id.247889 - Third Party Advisory~~	() https://vuldb.com/?id.247889 - Third Party Advisory

16 Dec 2023, 01:47

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-12-13 16:15

Updated : 2024-11-21 08:44

NVD link : CVE-2023-6761

Mitre link : CVE-2023-6761

CVE.ORG link : CVE-2023-6761

JSON object : View

Products Affected

thecosy

icecms

CWE

CWE-284

Improper Access Control

{"id": "CVE-2023-6761", "metrics": {"cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2023-12-13T16:15:12.473", "references": [{"url": "http://39.106.130.187/chui/1.html", "tags": ["Exploit", "Third Party Advisory"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?ctiid.247889", "tags": ["Permissions Required", "Third Party Advisory"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?id.247889", "tags": ["Third Party Advisory"], "source": "cna@vuldb.com"}, {"url": "http://39.106.130.187/chui/1.html", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://vuldb.com/?ctiid.247889", "tags": ["Permissions Required", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://vuldb.com/?id.247889", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability, which was classified as problematic, has been found in Thecosy IceCMS up to 2.0.1. This issue affects some unknown processing of the component User Data Handler. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247889 was assigned to this vulnerability."}, {"lang": "es", "value": "Una vulnerabilidad fue encontrada en Thecosy IceCMS hasta 2.0.1 y clasificada como problem\u00e1tica. Este problema afecta un procesamiento desconocido del componente User Data Handler. La manipulaci\u00f3n conduce a controles de acceso inadecuados. El ataque puede iniciarse de forma remota. El exploit ha sido divulgado al p\u00fablico y puede utilizarse. A esta vulnerabilidad se le asign\u00f3 el identificador VDB-247889."}], "lastModified": "2024-11-21T08:44:30.290", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:thecosy:icecms:2.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E8BFA839-61F5-4B6F-9A53-5BF6F0DADF20"}], "operator": "OR"}]}], "sourceIdentifier": "cna@vuldb.com"}