PT-2023-30874 · Unknown · Concrete Cms

Veshraj Ghimire · Published 2023-12-25 · Updated 2024-12-16 · CVE-2023-48653

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 8.5.14 Concrete CMS versions 9 prior to 9.2.3

Description The issue allows Cross Site Request Forgery (CSRF) via the "ccm/calendar/dialogs/event/delete/submit" API endpoint. An attacker can force an admin to delete events on the site because the event ID is numeric and sequential.

Recommendations For Concrete CMS versions prior to 8.5.14, update to version 8.5.14 or later. For Concrete CMS versions 9 prior to 9.2.3, update to version 9.2.3 or later. As a temporary workaround, consider restricting access to the "ccm/calendar/dialogs/event/delete/submit" API endpoint to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-48653

GHSA-3RXX-8F33-7P6P

Affected Products

Concrete Cms

References · 9

• https://concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-48653 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3rxx-8f33-7p6p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48653 · Security Note
• https://github.com/concretecms/concretecms · Note
• https://github.com/concretecms/concretecms/commit/5b93470bcccf271810d3a0b190368ce6a9d6c84b · Note
• https://github.com/concretecms/concretecms/commit/077755e6bbbc1c67b7508add9e3d207e8d8909a0 · Note
• https://twitter.com/CVEnew/status/1739363666242252866 · Twitter Post
• https://documentation.concretecms.org/developers/introduction/version-history/923-release-notes · Note