TI-2023-06173 Aliases CVE-2023-6756 GHSA-q8wg-hjx6-v9j8

Thecosy IceCMS Captcha login excessive authentication

MEDIUM 45CWE-307Published 2023-12-13 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-307.

Summary

A vulnerability was found in Thecosy IceCMS 2.0.1. It has been classified as problematic. Affected is an unknown function of the file /login of the component Captcha Handler. The manipulation leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247884.

Why it matters now

EPSS 0.01288 70th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA and NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Thecosy	IceCMS	2.0.1	—	No fix listed	CNA

IceCMS VendorThecosy Affected 2.0.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:thecosy:icecms:2.0.1:::::::*	2.0.1	Vulnerable	Thecosy

cpe:2.3:a:thecosy:icecms:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Thecosy

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-6756
2026-10-03 Alias added: GHSA-q8wg-hjx6-v9j8

References

Exploit 1

http://124.71.147.32:8082/IceCMS2.html

TI-2024-32301 icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile. CVSS 3.1CRITICAL 9.8
TI-2024-31064 IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an… CVSS 3.1CRITICAL 9.8
TI-2025-16813 An access control issue in the component /api/squareComment/DelectSquareById of iceCMS… CVSS 3.1HIGH 7.5
TI-2025-16812 An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0… CVSS 3.1HIGH 7.5
TI-2024-31063 An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily… CVSS 3.1HIGH 7.6
TI-2024-31061 Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by… CVSS 3.1HIGH 7.6

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences