Lucene search
MitreCVELIST:CVE-2024-46610HistorySep 24, 2024 - 12:00 a.m.
CVE-2024-46610
2024-09-2400:00:00
mitre
www.cve.org
2
access control
user info
crafted request
icecms v3.4.7
changeuser function
usercontroller.java
EPSS
0.001
Percentile
18.5%
An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily modify users’ information, including username and password, via a crafted POST request sent to the endpoint /User/ChangeUser/s in the ChangeUser function in UserController.java
