CVE-2024-31213 - CVE House
Back to Database
Status published Low CVE-2024-31213

InstantCMS Open Redirect vulnerability

Vulnerability Description

InstantCMS is a free and open source content management system. An open redirect was found in the ICMS2 application version 2.16.2 when being redirected after modifying one's own user profile. An attacker could trick a victim into visiting their web application, thinking they are still present on the ICMS2 application. They could then host a website stating "To update your profile, please enter your password," upon which the user may type their password and send it to the attacker. As of time of publication, a patched version is not available.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-31213

Credits & Attribution

No credits recorded in the NVD database.

References

More from instantsoft

View All →
CVE-2025-59055
InstantCMS vulnerable to Server-Side Request Forgery via package installer
Medium 4.7
CVE-2024-50348
InstantCMS has a Cross Site Scripting Vulnerability
Medium 5.4
CVE-2024-31212
SQL injection in index_chart_data action
Medium 6.7
CVE-2023-4928
SQL Injection in instantsoft/icms2
High 7.2
CVE-2023-4879
Cross-site Scripting (XSS) - Stored in instantsoft/icms2
Low 3.5

Affected Vendor

instantsoft

View all reports →

Affected Software

icms2
Vulnerable Versions:
< 2.16.2

Timeline

Official Publish: April 5th, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-601

MITRE ATT&CK TTPs

T1566 Phishing
Initial Access
T1204 User Execution
Execution
T1071 Application Layer Protocol
Command and Control
T1189 Drive-by Compromise
Initial Access
T1036 Masquerading
Defense Evasion