CVE-2018-13790: SSRF

Published Jul 9, 2018

Updated

A Server Side Request Forgery (SSRF) vulnerability in tools/files/importers/remote.php in concrete5 8.2.0 can lead to attacks on the local network and mapping of the internal network, because of URL functionality on the File Manager page.

Affected Software

1 affected component

ConcreteCMS Concrete CMS=8.2.0

Event History

Jul 9, 2018

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-13790?

CVE-2018-13790 is classified as a high-severity vulnerability due to its potential for Server Side Request Forgery attacks.

What are the effects of CVE-2018-13790?

CVE-2018-13790 can allow attackers to make unauthorized requests to the local network, potentially exposing sensitive internal resources.

How do I fix CVE-2018-13790?

To fix CVE-2018-13790, upgrade to a later version of Concrete CMS that addresses this vulnerability.

Which versions of Concrete5 are affected by CVE-2018-13790?

CVE-2018-13790 specifically affects Concrete5 version 8.2.0.

What is SSRF in the context of CVE-2018-13790?

SSRF, or Server Side Request Forgery, in the context of CVE-2018-13790 refers to the ability of an attacker to send crafted requests from the server to internal resources.