CVE-2023-48652

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-48652
Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) via /ccm/system/dialogs/logs/delete_all/submit. An attacker can force an admin user to delete server report logs on a web application to which they are currently authenticated.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://documentation.concretecms.org/developers/introduction/version-history/923-release-notes Release Notes
https://www.concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*
History

29 Dec 2023, 05:55

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.3
CPE cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*
CWE CWE-352
First Time Concretecms
Concretecms concrete Cms
References () https://documentation.concretecms.org/developers/introduction/version-history/923-release-notes - () https://documentation.concretecms.org/developers/introduction/version-history/923-release-notes - Release Notes
References () https://www.concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates - () https://www.concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates - Patch, Vendor Advisory

26 Dec 2023, 20:34

Type Values Removed Values Added
Summary
  • (es) Concrete CMS 9 anterior a 9.2.3 es vulnerable a Cross Site Request Forgery (CSRF) a través de /ccm/system/dialogs/logs/delete_all/submit. Un atacante puede obligar a un usuario administrador a eliminar los registros de informes del servidor en una aplicación web en la que está actualmente autenticado.

25 Dec 2023, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-25 08:15

Updated : 2023-12-29 05:55

NVD link : CVE-2023-48652

Mitre link : CVE-2023-48652

CVE.ORG link : CVE-2023-48652

JSON object : View

Products Affected

concretecms

  • concrete_cms
CWE
CWE-352

Cross-Site Request Forgery (CSRF)