CVE-2023-48653

Concrete CMS before 8.5.14 and 9 before 9.2.3 allows Cross Site Request Forgery (CSRF) via ccm/calendar/dialogs/event/delete/submit

published December 25, 2023

CVSS
—
EPSS
0%
Percentile
19.0
In the wild
Unconfirmed
What it is

Concrete CMS before 8.5.14 and 9 before 9.2.3 allows Cross Site Request Forgery (CSRF) via ccm/calendar/dialogs/event/delete/submit. An attacker can force an admin to delete events on the site because the event ID is numeric and sequential.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00276 · 19.0th percentile
Published
2023-12-25T00:00Z
EPSS history
Timeline
  • 25 DEC 00:00Z
    Concrete CMS before 8.5.14 and 9 before 9.2.3 allows Cross Site Request Forgery (CSRF) via ccm/calendar/dialogs/event/delete/submit
    cvelistv5