GHSA-w8fp-3gwq-gxpw
Concrete CMS vulnerable to Cross-site Request Forgery
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | concrete5/concrete5 | < 8.5.10 | 8.5.10 |
| Packagist | concrete5/concrete5 | >= 9.0.0RC1, < 9.1.3 | 9.1.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
Concrete CMS is vulnerable to CSRF due to the lack of "State" parameter for external Concrete authentication service for users of Concrete who use the "out of the box" core OAuth.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2022-43693
- https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes
- https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes
- https://github.com/concretecms/concretecms
- https://github.com/concretecms/concretecms/releases/8.5.10
- https://github.com/concretecms/concretecms/releases/9.1.3
- https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31