Description

concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored and allows for arbitrary domains to be set for certain links displayed to subsequent visitors, potentially an XSS vector.

Remediation

References

CVE-2017-7725

Related Vulnerabilities

Craft CMS Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2023-40035)

Moodle Generation of Error Message Containing Sensitive Information Vulnerability (CVE-2024-48896)

Ruby Cryptographic Issues Vulnerability (CVE-2013-4073)

Oracle Database Server Other Vulnerability (CVE-2001-0943)

WordPress Plugin Abandoned Cart Lite for WooCommerce Cross-Site Request Forgery (5.8.5)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2017-7725