CVE-2023-48653: Concrete CMS Cross Site Request Forgery (CSRF) vulnerability
Summary
CVE-2023-48653: Concrete CMS Cross Site Request Forgery (CSRF) vulnerability. Affects concrete5/concrete5 across 2 version ranges.
< 8.5.14
>= 9.0.0, < 9.2.3
Fixed in 8.5.14 or 9.2.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Concrete CMS is a content management system that allows users to create and manage websites. It provides a user-friendly interface and various features for website customization. However, versions before 8.5.14 and 9 before 9.2.3 are vulnerable to a Cross Site Request Forgery (CSRF) attack. This vulnerability allows an attacker to manipulate an admin user into unknowingly deleting events on the site.
Vulnerability Detail
The vulnerability exists in the 'ccm/calendar/dialogs/event/delete/submit' endpoint of Concrete CMS. By exploiting this vulnerability, an attacker can force an admin user to delete events on the site. The vulnerability is due to the event ID being numeric and sequential, making it predictable and easy to manipulate. This can lead to unauthorized deletion of events and potential disruption of the website's functionality.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.5.148.5.14composer require concrete5/concrete5:8.5.14 -
>= 9.0.0, < 9.2.39.2.3composer require concrete5/concrete5:9.2.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to implement additional CSRF protection measures, such as using anti-CSRF tokens in forms and validating the referer header in requests. However, upgrading to the patched versions is the recommended solution.
Conclusion
Concrete CMS versions before 8.5.14 and 9 before 9.2.3 are vulnerable to a Cross Site Request Forgery (CSRF) attack that allows an attacker to manipulate admin users into deleting events on the site. Upgrading to the patched versions or implementing additional CSRF protection measures is necessary to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for concrete5/concrete5 →
FAQ
Concrete CMS is a content management system that allows users to create and manage websites. It provides a user-friendly interface and various features for website customization.
A CSRF vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. In this case, the vulnerability allows an attacker to force an admin user to delete events on the site.
By manipulating the event ID in the 'ccm/calendar/dialogs/event/delete/submit' endpoint, an attacker can trick an admin user into unknowingly deleting events on the site.
The vulnerability can lead to unauthorized deletion of events on the website, potentially causing disruption to its functionality and user experience.
To fix this vulnerability, it is recommended to upgrade to Concrete CMS version 8.5.14 or later for versions before 8.5.14, and version 9.2.3 or later for versions 9.x. These versions include patches that address the CSRF vulnerability and prevent unauthorized deletion of events.
References
Related vulnerabilities
Recent vulnerabilities recorded for concrete5/concrete5.
