CVE-2017-7725 — MEDIUM (6.1)

Vulnerability Description

concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored and allows for arbitrary domains to be set for certain links displayed to subsequent visitors, potentially an XSS vector.

CVSS Score

6.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Concretecms	Concrete Cms	8.1.0

Related Weaknesses (CWE)

CWE-79

References

http://hyp3rlinx.altervista.org/advisories/CONCRETE5-v8.1.0-HOST-HEADER-INJECTIOExploitThird Party Advisory
http://www.securityfocus.com/bid/97649Third Party AdvisoryVDB Entry
https://hackerone.com/reports/148300ExploitThird Party AdvisoryVDB Entry
https://packetstormsecurity.com/files/142145/concrete5-8.1.0-Host-Header-InjectiExploitThird Party AdvisoryVDB Entry
https://www.exploit-db.com/exploits/41885/ExploitThird Party AdvisoryVDB Entry
http://hyp3rlinx.altervista.org/advisories/CONCRETE5-v8.1.0-HOST-HEADER-INJECTIOExploitThird Party Advisory
http://www.securityfocus.com/bid/97649Third Party AdvisoryVDB Entry
https://hackerone.com/reports/148300ExploitThird Party AdvisoryVDB Entry
https://packetstormsecurity.com/files/142145/concrete5-8.1.0-Host-Header-InjectiExploitThird Party AdvisoryVDB Entry
https://www.exploit-db.com/exploits/41885/ExploitThird Party AdvisoryVDB Entry

FAQ

What is CVE-2017-7725?

CVE-2017-7725 is a vulnerability with a CVSS score of 6.1 (MEDIUM). concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings....

How severe is CVE-2017-7725?

CVE-2017-7725 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-7725?

Check the references section above for vendor advisories and patch information. Affected products include: Concretecms Concrete Cms.