GitHub Advisoryadvisory · Packagist

GHSA-gr23-g276-xc73 Cross Site Request Forgery in concrete5/concrete5

HIGH Published 2022-02-11 Modified 2022-02-16 Official page ↗

Aliases: CVE-2021-22954
Ecosystem: Packagist
Packages: concrete5/concrete5
Severity: High
Weaknesses: CWE-352
Reviewed: 2022-02-16

Affected packages

• Packagist concrete5/concrete5: < 9.0.0 → fixed in 9.0.0

Description

A cross-site request forgery vulnerability exists in Concrete CMS <v9 that could allow an attacker to make requests on behalf of other users.

Related

Alias · CVE (1)

CVE-2021-22954 A cross-site request forgery vulnerability exists in Concrete CMS <v9 that could allow an attacker to make requests on behalf of other… vulnerability

Weakness · CWE (1)

CWE-352 Cross-Site Request Forgery weakness

References