PT-2017-18109 · Concrete5 · Concrete5

Publicado 2017-04-24 · Atualizado 2021-07-15 · CVE-2017-8082

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions concrete5 version 8.1.0

Description The issue allows remote attackers to disable the entire installation by tricking an admin into viewing a malicious page involving the "/tools/required/files/importers/imageeditor?fID=1&imgData=" URI, resulting in a site-wide denial of service. This makes the site not accessible to any users or administrators. The fID and imgData variables are involved in the exploitation.

Recommendations For concrete5 version 8.1.0, as a temporary workaround, consider restricting access to the Thumbnail Editor in the File Manager to minimize the risk of exploitation. Avoid using the fID and imgData variables in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2017-8082

Produtos afetados

Concrete5

Referências · 7

• 🔥 http://zeroday.insecurity.zone/exploits/concrete5_csrf_dos.txt · Exploit
• 🔥 https://drive.google.com/open?id=0B3vXUYdNMECWZTd3SFRnUjllWk0 · Exploit
• https://twitter.com/insecurity/status/856066923146215425 · Nota
• https://t.me/cvenotify/17699 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2017-8082 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-8082 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8082 · Nota