CVE-2023-48651: Concrete CMS Cross Site Request Forgery (CSRF) vulnerability
Summary
CVE-2023-48651: Concrete CMS Cross Site Request Forgery (CSRF) vulnerability. Affects concrete5/concrete5 versions >= 9.0.0, < 9.2.3. Fixed in 9.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Concrete CMS is a content management system that allows users to create and manage websites. It provides a range of features such as customizable templates, drag-and-drop content editing, and user management. The vulnerability identified in Concrete CMS version 9 before 9.2.3 is a Cross Site Request Forgery (CSRF) vulnerability. This type of vulnerability allows an attacker to trick a user into performing unwanted actions on their behalf, potentially leading to unauthorized access or data manipulation.
Vulnerability Detail
The specific vulnerability in Concrete CMS version 9 before 9.2.3 is located at /ccm/system/dialogs/file/delete/1/submit. This endpoint is susceptible to Cross Site Request Forgery attacks, where an attacker can craft a malicious request that appears to come from a trusted source. If a user with sufficient privileges visits a webpage or clicks on a link that triggers this request, the attacker can perform actions on behalf of the user without their consent. This could include deleting files, modifying content, or gaining unauthorized access to sensitive information.
How To Fix
Minimum fixed version
9.2.3
This is the first release that contains the fix.
composer require concrete5/concrete5:9.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Cross Site Request Forgery (CSRF) vulnerability in Concrete CMS version 9 before 9.2.3 can allow attackers to perform unauthorized actions on behalf of users. To mitigate this vulnerability, it is crucial to update to Concrete CMS version 9.2.3 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for concrete5/concrete5 →
FAQ
Concrete CMS is a content management system that allows users to create and manage websites. It provides a range of features such as customizable templates, drag-and-drop content editing, and user management.
A Cross Site Request Forgery (CSRF) vulnerability is a type of security vulnerability that allows an attacker to trick a user into performing unwanted actions on their behalf. This can lead to unauthorized access, data manipulation, or other malicious activities.
The CSRF vulnerability in Concrete CMS allows an attacker to perform actions on behalf of a user without their consent. This could include deleting files, modifying content, or gaining unauthorized access to sensitive information.
To protect your Concrete CMS installation from CSRF attacks, it is recommended to upgrade to version 9.2.3 or later, which includes a patch for the vulnerability. Additionally, users should be cautious when clicking on links or visiting websites that may be malicious.
No specific workaround is mentioned for this vulnerability. It is recommended to upgrade to the latest version of Concrete CMS to ensure the security of your installation.
Related vulnerabilities
Recent vulnerabilities recorded for concrete5/concrete5.
