PT-2018-12187 · Concrete5 · Concrete5

Publicado 2018-07-09 · Atualizado 2021-07-15 · CVE-2018-13790

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions concrete5 version 8.2.0

Description A Server Side Request Forgery (SSRF) issue in the remote.php file can lead to attacks on the local network and mapping of the internal network, due to URL functionality on the File Manager page.

Recommendations For concrete5 version 8.2.0, consider restricting access to the remote.php file in the tools/files/importers directory to minimize the risk of exploitation. As a temporary workaround, limit the use of URL functionality on the File Manager page until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2018-13790

Produtos afetados

Concrete5

Referências · 5

• 🔥 https://hackerone.com/reports/243865 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-13790 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-13790 · Aviso do Fabricante
• https://t.me/cvenotify/17698 · Publicação no Telegram
• https://t.me/cvenotify/12391 · Publicação no Telegram