High · 7.6 CVE-2024-46607 EUVD-2024-41911GHSA-rm3j-jj6h-qrq4

Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and …

Published Sep 24, 2024 · Updated Jul 5, 2026 · Assigned by mitre

Description

Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the loginAdmin method in the UserController.java file.

References

https://github.com/Thecosy/iceCMS?tab=readme-ov-file
https://github.com/Lunax0/LogLunax/blob/main/icecms/CVE-2024-46607.md