PT-2023-30874 · Unknown · Concrete Cms

Veshraj Ghimire · Publicado 2023-12-25 · Atualizado 2024-12-16 · CVE-2023-48653

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 8.5.14 Concrete CMS versions 9 prior to 9.2.3

Description The issue allows Cross Site Request Forgery (CSRF) via the "ccm/calendar/dialogs/event/delete/submit" API endpoint. An attacker can force an admin to delete events on the site because the event ID is numeric and sequential.

Recommendations For Concrete CMS versions prior to 8.5.14, update to version 8.5.14 or later. For Concrete CMS versions 9 prior to 9.2.3, update to version 9.2.3 or later. As a temporary workaround, consider restricting access to the "ccm/calendar/dialogs/event/delete/submit" API endpoint to minimize the risk of exploitation.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-48653

GHSA-3RXX-8F33-7P6P

Produtos afetados

Concrete Cms

Referências · 9

• https://github.com/concretecms/concretecms · Nota
• https://github.com/concretecms/concretecms/commit/5b93470bcccf271810d3a0b190368ce6a9d6c84b · Nota
• https://github.com/concretecms/concretecms/commit/077755e6bbbc1c67b7508add9e3d207e8d8909a0 · Nota
• https://twitter.com/CVEnew/status/1739363666242252866 · Publicação no Twitter
• https://concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-48653 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-3rxx-8f33-7p6p · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-48653 · Nota de Segurança
• https://documentation.concretecms.org/developers/introduction/version-history/923-release-notes · Nota