PT-2017-18109 · Concrete5 · Concrete5

Published 2017-04-24 · Updated 2021-07-15 · CVE-2017-8082

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions concrete5 version 8.1.0

Description The issue allows remote attackers to disable the entire installation by tricking an admin into viewing a malicious page involving the "/tools/required/files/importers/imageeditor?fID=1&imgData=" URI, resulting in a site-wide denial of service. This makes the site not accessible to any users or administrators. The fID and imgData variables are involved in the exploitation.

Recommendations For concrete5 version 8.1.0, as a temporary workaround, consider restricting access to the Thumbnail Editor in the File Manager to minimize the risk of exploitation. Avoid using the fID and imgData variables in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-8082

Affected Products

Concrete5

References · 7

• 🔥 http://zeroday.insecurity.zone/exploits/concrete5_csrf_dos.txt · Exploit
• 🔥 https://drive.google.com/open?id=0B3vXUYdNMECWZTd3SFRnUjllWk0 · Exploit
• https://osv.dev/vulnerability/CVE-2017-8082 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8082 · Security Note
• https://twitter.com/insecurity/status/856066923146215425 · Note
• https://t.me/cvenotify/17699 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8082 · Note