Skip to content
Threat Feed
Subscribe

Product

IceCMS (<= 4.1.5)

1 brief RSS
critical advisory

Authentication Bypass in IceCMS via Shiro JWT Filter Misconfiguration

IceCMS versions through 4.1.5 contain a missing authentication vulnerability allowing unauthenticated attackers to perform full account takeover via the /User/updateUser API endpoint.

IceCMS authentication-bypass cms web-application
1r 2t 1c