CVE-2017-7725
CVE-2017-7725
This page contains facts from public vulnerability sources. Check the original advisory before updating.
concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored and allows for arbitrary domains to be set for certain links displayed to subsequent visitors, potentially an XSS vector.
CVSS 6.1 · Medium · EPSS 2.8% · Public exploit
- Published
- Updated
Stack: php
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
concrete5/concrete5 Packagist
- Versions
- 8.0
- 8.0.1
- 8.0.2
- 8.0.3
- 8.1.0
- Affected ranges
- ECOSYSTEM: ≤ 8.1.0
No fix published
Original sources
- https://www.exploit-db.com/exploits/41885/
- http://hyp3rlinx.altervista.org/advisories/CONCRETE5-v8.1.0-HOST-HEADER-INJECTION.txt
- https://packetstormsecurity.com/files/142145/concrete5-8.1.0-Host-Header-Injection.html
- http://www.securityfocus.com/bid/97649
- https://hackerone.com/reports/148300
- https://nvd.nist.gov/vuln/detail/CVE-2017-7725