CVE-2023-6758: medium-severity vulnerability in Thecosy IceCMS
Thecosy IceCMS API PlanetCommentList access control
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.7%
A vulnerability was found in Thecosy IceCMS 2.0.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /adplanet/PlanetCommentList of the component API. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-247886 is the identifier assigned to this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Thecosy · IceCMSRelated CVEs — Thecosy IceCMS
In the same product, most dangerous first.
CVE-2023-6756MEDIUMThecosy IceCMS Captcha login excessive authenticationEPSS 1.3%CVE-2023-6757MEDIUMThecosy IceCMS API PlanetUser information disclosureEPSS 1.0%CVE-2023-6759MEDIUMThecosy IceCMS Love resource improper enforcement of a single, unique actionEPSS 1.0%CVE-2023-6761MEDIUMThecosy IceCMS User Data access controlEPSS 0.8%CVE-2023-6438MEDIUMThecosy IceCMS Like improper enforcement of a single, unique actionEPSS 0.7%CVE-2023-6762MEDIUMThecosy IceCMS Article permissionEPSS 0.7%