CVE-2017-8082: CSRF
concrete5 8.1.0 has CSRF in Thumbnail Editor in the File Manager, which allows remote attackers to disable the entire installation by merely tricking an admin into viewing a malicious page involving the /tools/required/files/importers/imageeditor?fID=1&imgData= URI. This results in a site-wide denial of service making the site not accessible to any users or any administrators.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
concrete5to a version that resolves this vulnerability.Fixed in 8.1.0 - Compensating control
Mitigate the CSRF issue in concrete5 Thumbnail Editor by preventing admins from accessing the vulnerable File Manager thumbnail editor endpoint /tools/required/files/importers/imageeditor?fID=1&imgData= (e.g., block/deny access to this path at a web application firewall or reverse proxy while patching).
Event History
Frequently Asked Questions
What is the severity of CVE-2017-8082?
CVE-2017-8082 has a high severity rating due to its ability to disable the entire concrete5 installation.
How do I fix CVE-2017-8082?
To fix CVE-2017-8082, upgrade your concrete5 installation to a version later than 8.1.0 that addresses the CSRF vulnerability.
What is the impact of CVE-2017-8082 on my website?
CVE-2017-8082 allows remote attackers to execute actions that can disable your concrete5 site if an admin visits a malicious page.
Which versions of Concrete5 are affected by CVE-2017-8082?
CVE-2017-8082 specifically affects Concrete5 version 8.1.0.
Is user interaction required for CVE-2017-8082 to be exploited?
Yes, CVE-2017-8082 requires user interaction, as it relies on tricking an admin into viewing a malicious page.