CVE-2024-46607

HIGH

CVSS v3.1: 7.6 · EPSS: 0.0057 (43.2 percentile)

Network

Source data as of:

At a glance

Severity
HIGH
CVSS
7.6 v3.1 · NVD
EPSS
0.0057 (43.2 percentile) · FIRST.org
CISA KEV
No
Attack conditions (CVSS vector)
Network · Source: NVD Vector
Affected vendors
thecosy
Published
2024-09-25 · Modified: 2026-07-05
References
Jump to references (2)

CVSS / EPSS / KEV

CVSS v3.1 7.6 / 10 HIGH Source: NVD
EPSS 0.0057 43.2 percentile Source: FIRST.org
CISA KEV No Source: CISA

Source — CVSS: NVD · EPSS: FIRST.org · KEV: CISA. Data & Sources

Description

Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and password via the loginAdmin method in the UserController.java file.

Record details

CVE ID
CVE-2024-46607
CVSS (v3.1)
7.6 (HIGH)
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
Exploitability subscore
2.1
Impact subscore
5.5
EPSS
0.0057 (43.2 percentile) — 2026-07-05
CISA KEV
No
Weakness (CWE)
CWE-284
Affected vendors
thecosy
Affected configurations (CPE)
1
Published
2024-09-25
Modified
2026-07-05
Status
Modified

References

Reference URLs as listed by NVD, grouped by a mechanical match on the link's host/pattern. Labels describe the link type only.

Related records

Other records sharing a factual facet, for cross-reference. A descriptive neighbourhood — ordering does not imply priority and is not a recommendation.

Same weakness type (CWE)

CVE-2025-60306 CRITICAL CVSS 9.9 CVE-2025-66956 CRITICAL CVSS 9.9 CVE-2023-43141 CRITICAL CVSS 9.8 CVE-2023-47031 CRITICAL CVSS 9.8

Published the same year

CVE-2024-33109 CRITICAL CVSS 9.9 CVE-2024-22901 CRITICAL CVSS 9.8 CVE-2024-22902 CRITICAL CVSS 9.8 CVE-2024-22922 CRITICAL CVSS 9.8
← Back to all records