GitHub Advisoryadvisory · Packagist

GHSA-f55r-8rcv-mqcf Concrete CMS missing secure cookie parameters

MEDIUM Published 2023-04-28 Modified 2023-11-22 Official page ↗
Aliases
CVE-2023-28472
Ecosystem
Packagist
Packages
concrete5/concrete5
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-613
Reviewed
2023-04-28

Affected packages

• Packagist concrete5/concrete5: < 9.2.0 → fixed in 9.2.0

Description

Concrete CMS (previously concrete5) before 9.2 does not have Secure and HTTP only attributes set for ccmPoll cookies.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2023-28472 Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 does not have Secure and HTTP only attributes set for… vulnerability

References