CVE-2023-4704 : External Control of System or Configuration Setting in GitHub repository instant

External Control of System or Configuration Setting in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

Published 2023-09-01 10:15:09

Updated 2023-09-07 17:36:23

Source huntr.dev

View at NVD, CVE.org

Products affected by CVE-2023-4704

Instantcms » Instantcms
Versions before (<) 2.16.1
cpe:2.3:a:instantcms:instantcms:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 41 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
8.8	HIGH	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	huntr.dev
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
4.9	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	1.2	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE-15 External Control of System or Configuration Setting

One or more system settings or configuration elements can be externally controlled by a user.

Assigned by: security@huntr.dev (Secondary)
CWE-610 Externally Controlled Reference to a Resource in Another Sphere

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Assigned by: nvd@nist.gov (Primary)

https://huntr.dev/bounties/4a54134d-df1f-43d4-9b14-45f023cd654a

Misconfiguration in message sending function vulnerability found in icms2
Exploit
https://github.com/instantsoft/icms2/commit/bc22d89691fdaf38055eba13dda8d959b16fa731

Forbid contact with myself · instantsoft/icms2@bc22d89 · GitHub
Patch

Jump to