Skip to main content

Instantcms CVE-2023-4704

MEDIUM
External Control of System or Configuration Setting (CWE-15)
2023-09-01 security@huntr.dev
Information Disclosure Instantcms
4.9
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.9 MEDIUM
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Sep 01, 2023 - 10:15 nvd
MEDIUM 4.9

DescriptionNVD

External Control of System or Configuration Setting in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

AnalysisAI

External Control of System or Configuration Setting in GitHub repository instantsoft/icms2 prior to 2.16.1-git. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-15. External Control of System or Configuration Setting in GitHub repository instantsoft/icms2 prior to 2.16.1-git. Affected products include: Instantcms. Version information: prior to 2.16.1.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Instantcms

View all
CVE-2013-10051 CRITICAL POC
9.3 Aug 01

A remote PHP code execution vulnerability exists in InstantCMS version 1.6 and earlier due to unsafe use of eval() withi
CVE-2023-4188 CRITICAL POC
9.1 Aug 05

SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1-git. Rated critical severity (CVSS 9.1), this vulne
CVE-2013-6839 HIGH POC
7.5 Dec 13

SQL injection vulnerability in InstantSoft InstantCMS 1.10.3 and earlier allows remote attackers to execute arbitrary SQ
CVE-2024-31212 HIGH POC
7.2 Apr 04

InstantCMS is a free and open source content management system. Rated high severity (CVSS 7.2), this vulnerability is re
CVE-2023-4655 MEDIUM POC
6.1 Aug 31

Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1. Rated medium severity (CV
CVE-2018-14382 MEDIUM POC
6.1 Jul 18

InstantCMS 2.10.1 has /redirect?url= XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable,

CVE-2024-50348 MEDIUM POC
5.4 Oct 29

InstantCMS is a free and open source content management system. Rated medium severity (CVSS 5.4), this vulnerability is

CVE-2024-31213 MEDIUM POC
5.4 Apr 05

InstantCMS is a free and open source content management system. Rated medium severity (CVSS 5.4), this vulnerability is

CVE-2023-4878 MEDIUM POC
5.4 Sep 10

Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1-git. Rated medium severity (CV
CVE-2023-4652 MEDIUM POC
5.4 Aug 31

Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git. Rated medium severity (C
CVE-2023-4651 MEDIUM POC
5.4 Aug 31

Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1. Rated medium severity (CVSS 5
CVE-2023-4649 MEDIUM POC
5.4 Aug 31

Session Fixation in GitHub repository instantsoft/icms2 prior to 2.16.1. Rated medium severity (CVSS 5.4), this vulnerab

Same weakness CWE-15 – External Control of System or Configuration Setting

View all
CVE-2026-45087 CRITICAL POC
10.0
CVE-2024-4326 CRITICAL POC
9.8
CVE-2023-50252 CRITICAL POC
9.8
CVE-2023-46248 HIGH POC
8.8
CVE-2023-43323 MEDIUM POC
6.5
CVE-2026-22708 CRITICAL
9.8
CVE-2026-46399 CRITICAL
9.4
CVE-2021-38453 CRITICAL
9.1

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2023-4704 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy