Plattform
php
Komponente
icecms
Behoben in
2.0.2
CVE-2023-6466 is a cross-site scripting (XSS) vulnerability affecting IceCMS versions 2.0.1 through 2.0.1. This flaw allows attackers to inject malicious scripts into the application, potentially leading to session hijacking or defacement. The vulnerability resides within the User Comment Handler component. A fix is available in version 2.0.2.
Successful exploitation of CVE-2023-6466 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser. This can be leveraged to steal session cookies, redirect users to malicious websites, or modify the content of the website. The impact is particularly severe if the application handles sensitive user data or is used in a critical business process. Given the nature of XSS vulnerabilities, the attacker's actions are limited only by the permissions of the user whose session is hijacked.
This vulnerability has been publicly disclosed and a proof-of-concept may be available. The CVSS score is LOW, suggesting that exploitation is likely to require some level of user interaction or specific targeting. The vulnerability was published on 2023-12-02. No active exploitation campaigns are currently known, but the public disclosure increases the risk of future attacks.
Websites using IceCMS version 2.0.1 are at risk. This includes organizations that rely on IceCMS for content management and user interaction. Shared hosting environments where IceCMS is installed are particularly vulnerable, as they may be difficult to update quickly.
• php / web:
curl -I 'http://your-icecms-site.com/planet?comment=<script>alert(1)</script>' | grep -i 'content-type'• generic web:
curl -s 'http://your-icecms-site.com/planet' | grep -i '<script>' disclosure
patch
Exploit-Status
EPSS
0.08% (24% Perzentil)
CVSS-Vektor
The primary mitigation for CVE-2023-6466 is to upgrade IceCMS to version 2.0.2 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing input validation and output encoding on user-supplied data within the User Comment Handler. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Regularly review and update security rules to ensure they are effective against emerging threats.
Actualizar IceCMS a una versión posterior a la 2.0.1 que corrija la vulnerabilidad de Cross-Site Scripting (XSS). Consultar el sitio web del proveedor para obtener la última versión y las instrucciones de actualización. Como medida temporal, se puede implementar un filtro de entrada para evitar la inyección de código malicioso en los comentarios de los usuarios.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2023-6466 is a cross-site scripting (XSS) vulnerability in IceCMS versions 2.0.1–2.0.1, allowing attackers to inject malicious scripts via the User Comment Handler.
If you are using IceCMS version 2.0.1, you are potentially affected by this vulnerability. Upgrade to version 2.0.2 or later to mitigate the risk.
The recommended fix is to upgrade IceCMS to version 2.0.2 or later. As a temporary measure, implement input validation and output encoding.
While no active exploitation campaigns are currently known, the public disclosure increases the risk of future attacks. Proactive mitigation is recommended.
Refer to the IceCMS website or security mailing lists for the official advisory regarding CVE-2023-6466.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.