CVE-2017-8082

2017-04-2406:59:00

Google

osv.dev

6.9 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.3%

JSON

concrete5 8.1.0 has CSRF in Thumbnail Editor in the File Manager, which allows remote attackers to disable the entire installation by merely tricking an admin into viewing a malicious page involving the /tools/required/files/importers/imageeditor?fID=1&imgData= URI. This results in a site-wide denial of service making the site not accessible to any users or any administrators.

CPENameOperatorVersion
concrete5eq5.7.4
concrete5eq8.0.2
concrete5eq8.1.0
concrete5eq5.7.5.9
concrete5eq8.0.1
concrete5eq5.7.5.1
concrete5eq5.7.5.11
concrete5eq5.7.5.3
concrete5eq5.7.5.12
concrete5eq5.7.0.4

Name	Operator	Version
concrete5	eq	5.7.4
concrete5	eq	8.0.2
concrete5	eq	8.1.0
concrete5	eq	5.7.5.9
concrete5	eq	8.0.1
concrete5	eq	5.7.5.1
concrete5	eq	5.7.5.11
concrete5	eq	5.7.5.3
concrete5	eq	5.7.5.12
concrete5	eq	5.7.0.4