GHSA-f55r-8rcv-mqcf
Suggest an improvement- Source
- https://github.com/advisories/GHSA-f55r-8rcv-mqcf
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-f55r-8rcv-mqcf/GHSA-f55r-8rcv-mqcf.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-f55r-8rcv-mqcf
- Aliases
-
- CVE-2023-28472
- Published
- 2023-04-28T15:30:18Z
- Modified
- 2024-02-16T08:09:47.835498Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- Concrete CMS missing secure cookie parameters
- Details
-
Concrete CMS (previously concrete5) before 9.2 does not have Secure and HTTP only attributes set for ccmPoll cookies.
- Database specific
{ "nvd_published_at": "2023-04-28T14:15:10Z", "cwe_ids": [ "CWE-613" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2023-04-28T20:40:05Z" }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2023-28472
- https://github.com/concretecms/concretecms/pull/11749
- https://concretecms.com
- https://github.com/concretecms/concretecms
- https://github.com/concretecms/concretecms/releases/tag/8.5.13
- https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release
- https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20
Affected packages
Packagist / concrete5/concrete5
Package
- Name
- concrete5/concrete5
- Purl
- pkg:composer/concrete5/concrete5
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed9.2.0
Affected versions
8.*
8.0
8.0.1
8.0.2
8.0.3
8.1.0
8.2.0RC2
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.4.0RC3
8.4.0RC4
8.4.0
8.4.1
8.4.2
8.4.3
8.4.4
8.4.5
8.5.0RC1
8.5.0RC2
8.5.0
8.5.1
8.5.2
8.5.3
8.5.4
8.5.5
8.5.6RC1
8.5.6
8.5.7
8.5.8
8.5.9
8.5.10
8.5.11
8.5.12
8.5.13
8.5.14
8.5.15
8.5.99
9.*
9.0.0RC1
9.0.0RC3
9.0.0RC4
9.0.0
9.0.1
9.0.2
9.1.0
9.1.1
9.1.2
9.1.3
9.2.0RC2