CVE-2022-43693 - Vulnerability Details - OpenCVE

Concrete CMS is vulnerable to CSRF due to the lack of "State" parameter for external Concrete authentication service for users of Concrete who use the "out of the box" core OAuth.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00864.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Concretecms	Concrete Cms

Configuration 1 [-]

OR	cpe:2.3:a:concretecms:concrete_cms::::::::
	cpe:2.3:a:concretecms:concrete_cms::::::::

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2022-7449	Concrete CMS vulnerable to Cross-site Request Forgery
Github GHSA	GHSA-w8fp-3gwq-gxpw	Concrete CMS vulnerable to Cross-site Request Forgery

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes
https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes
https://github.com/concretecms/concretecms/releases/8.5.10
https://github.com/concretecms/concretecms/releases/9.1.3
https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31

History

Wed, 30 Apr 2025 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-11-14T00:00:00.000Z

Updated: 2025-04-30T15:09:16.135Z

Reserved: 2022-10-24T00:00:00.000Z

Link: CVE-2022-43693

Vulnrichment

Updated: 2024-08-03T13:40:06.622Z

NVD

Status : Modified

Published: 2022-11-14T17:15:10.433

Modified: 2025-04-30T15:15:58.473

Link: CVE-2022-43693

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-43693", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-04-30T15:09:16.135Z", "dateReserved": "2022-10-24T00:00:00.000Z", "datePublished": "2022-11-14T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2022-11-14T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Concrete CMS is vulnerable to CSRF due to the lack of \"State\" parameter for external Concrete authentication service for users of Concrete who use the \"out of the box\" core OAuth."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/concretecms/concretecms/releases/9.1.3"}, {"url": "https://github.com/concretecms/concretecms/releases/8.5.10"}, {"url": "https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes"}, {"url": "https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes"}, {"url": "https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T13:40:06.622Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/concretecms/concretecms/releases/9.1.3", "tags": ["x_transferred"]}, {"url": "https://github.com/concretecms/concretecms/releases/8.5.10", "tags": ["x_transferred"]}, {"url": "https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes", "tags": ["x_transferred"]}, {"url": "https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes", "tags": ["x_transferred"]}, {"url": "https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-352", "lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-30T15:08:21.952626Z", "id": "CVE-2022-43693", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-30T15:09:16.135Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/concretecms/concretecms/releases/9.1.3", "tags": ["x_transferred"]}, {"url": "https://github.com/concretecms/concretecms/releases/8.5.10", "tags": ["x_transferred"]}, {"url": "https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes", "tags": ["x_transferred"]}, {"url": "https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes", "tags": ["x_transferred"]}, {"url": "https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T13:40:06.622Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-43693", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-30T15:08:21.952626Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-30T15:08:55.336Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/concretecms/concretecms/releases/9.1.3"}, {"url": "https://github.com/concretecms/concretecms/releases/8.5.10"}, {"url": "https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes"}, {"url": "https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes"}, {"url": "https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31"}], "descriptions": [{"lang": "en", "value": "Concrete CMS is vulnerable to CSRF due to the lack of \"State\" parameter for external Concrete authentication service for users of Concrete who use the \"out of the box\" core OAuth."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2022-11-14T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-43693", "state": "PUBLISHED", "dateUpdated": "2025-04-30T15:09:16.135Z", "dateReserved": "2022-10-24T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2022-11-14T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "3CB5F09B-26E8-43F3-85FE-5CEEA6EED9D8", "versionEndExcluding": "8.5.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "5A5E1A3A-03FB-4B91-8AF1-FE4B458263C3", "versionEndIncluding": "9.1.2", "versionStartIncluding": "9.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Concrete CMS is vulnerable to CSRF due to the lack of \"State\" parameter for external Concrete authentication service for users of Concrete who use the \"out of the box\" core OAuth."}, {"lang": "es", "value": "Concrete CMS es vulnerable a Cross-Site Request Forgery (CSRF) debido a la falta del par\u00e1metro \"State\" para el servicio de autenticaci\u00f3n externo de Concrete para usuarios de Concrete que utilizan el n\u00facleo OAuth \"out of the box\"."}], "id": "CVE-2022-43693", "lastModified": "2025-04-30T15:15:58.473", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-11-14T17:15:10.433", "references": [{"source": "cve@mitre.org", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes"}, {"source": "cve@mitre.org", "tags": ["Patch", "Release Notes", "Third Party Advisory"], "url": "https://github.com/concretecms/concretecms/releases/8.5.10"}, {"source": "cve@mitre.org", "tags": ["Patch", "Release Notes", "Third Party Advisory"], "url": "https://github.com/concretecms/concretecms/releases/9.1.3"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Release Notes", "Third Party Advisory"], "url": "https://github.com/concretecms/concretecms/releases/8.5.10"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Release Notes", "Third Party Advisory"], "url": "https://github.com/concretecms/concretecms/releases/9.1.3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-352"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}