CVE-2023-4654 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	3.5 LOW	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
@huntrdev	CNA	2.6 LOW	NETWORK	HIGH	LOW	CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
CVE	ADP	---				---
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 9%

Vendor	Product	Version
instantcms	instantcms	𝑥 < 2.16.1

𝑥

= Vulnerable software versions

Known Exploits!

Common Weakness Enumeration

CWE-614 - Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.

References

https://github.com/instantsoft/icms2/commit/ca5f150da11d9caae86638885137afe35bcc3592

https://huntr.dev/bounties/56432a75-af43-4b1a-9307-bd8de568351b

https://github.com/instantsoft/icms2/commit/ca5f150da11d9caae86638885137afe35bcc3592

https://huntr.dev/bounties/56432a75-af43-4b1a-9307-bd8de568351b