CVE Vulnerability

CVE-2022-43693

Concrete CMS is vulnerable to CSRF due to the lack of "State" parameter for external Concrete authentication service for users of Concrete who use the "out of the box" core OAuth.

8.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/concretecms/concretecms/releases/8.5.10 Patch Release Notes
https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes Release Notes Vendor Advisory
https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes Release Notes Vendor Advisory
https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31 Vendor Advisory
https://github.com/concretecms/concretecms/releases/9.1.3 Patch Release Notes
Configurations

Configuration 1

cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*
cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*
Information

Published : 2022-11-14 05:15

Updated : 2022-11-17 09:55

NVD link : CVE-2022-43693

Mitre link : CVE-2022-43693

Products Affected
No products.
CWE
CWE-352