CVE-2018-13790

Published: Jul 9, 2018Modified: Nov 21, 2024

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

A Server Side Request Forgery (SSRF) vulnerability in tools/files/importers/remote.php in concrete5 8.2.0 can lead to attacks on the local network and mapping of the internal network, because of URL functionality on the File Manager page.

Affected (1)

Products: Concretecms: Concrete Cms

Concretecms

1 product

Concrete Cms

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Concretecms Concrete Cms	Version 8.2.0

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (2)

https://hackerone.com/reports/243865

Source: cve@mitre.org

ExploitThird Party Advisory

https://hackerone.com/reports/243865

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.