CVE-2023-48652: CSRF
Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) via /ccm/system/dialogs/logs/deleteall/submit. An attacker can force an admin user to delete server report logs on a web application to which they are currently authenticated.
Other sources
Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) via /ccm/system/dialogs/logs/deleteall/submit. An attacker can force an admin user to delete server report logs on a web application to which they are currently authenticated.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-48652?
CVE-2023-48652 is considered a high severity vulnerability due to its potential impact on admin user actions.
How do I fix CVE-2023-48652?
To fix CVE-2023-48652, upgrade Concrete CMS to version 9.2.3 or later.
Who is affected by CVE-2023-48652?
CVE-2023-48652 affects all users of Concrete CMS versions before 9.2.3.
What type of vulnerability is CVE-2023-48652?
CVE-2023-48652 is a Cross Site Request Forgery (CSRF) vulnerability.
What can an attacker do with CVE-2023-48652?
An attacker can exploit CVE-2023-48652 to force an admin user to delete important server report logs.