CVE-2023-4650 : Improper Access Control in GitHub repository instantsoft/icms2 prior to 2.16.1-g

Improper Access Control in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

Published 2023-08-31 01:15:10

Updated 2023-09-05 19:14:56

Source huntr.dev

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Products affected by CVE-2023-4650

Instantcms » Instantcms
Versions before (<) 2.16.1
cpe:2.3:a:instantcms:instantcms:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 27 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.7	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L	1.2	3.4	huntr.dev
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: Low
4.7	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L	1.2	3.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: Low

CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Assigned by: security@huntr.dev (Primary)

https://huntr.dev/bounties/d92e8985-9d9d-4a62-92e8-ada014ee3b17

huntr: Page not found
Exploit;Patch;Third Party Advisory
https://github.com/instantsoft/icms2/commit/78ff8ca066e86a65ff35470b5622be3aa7d2f928

Administrators cannot change other administrators' passwords · instantsoft/icms2@78ff8ca · GitHub
Patch

Jump to