PT-2023-30873 · Unknown · Concrete Cms

Veshraj Ghimire · Publicado 2023-12-25 · Atualizado 2023-12-29 · CVE-2023-48652

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.0.0 through 9.2.2

Description The issue allows an attacker to force an admin user to delete server report logs on a web application to which they are currently authenticated via the API endpoint "/ccm/system/dialogs/logs/delete all/submit". This is a Cross Site Request Forgery (CSRF) issue.

Recommendations For Concrete CMS versions 9.0.0 through 9.2.2, update to version 9.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/ccm/system/dialogs/logs/delete all/submit" API endpoint to minimize the risk of exploitation.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-48652

GHSA-QP42-5PJ7-4CCM

Produtos afetados

Concrete Cms

Referências · 8

• https://github.com/concretecms/concretecms · Nota
• https://osv.dev/vulnerability/CVE-2023-48652 · Aviso do Fabricante
• https://concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-48652 · Nota de Segurança
• https://t.me/cvenotify/65105 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-qp42-5pj7-4ccm · Aviso do Fabricante
• https://documentation.concretecms.org/developers/introduction/version-history/923-release-notes · Nota
• https://twitter.com/VulmonFeeds/status/1739246485559017942 · Publicação no Twitter