CVE-2017-7725 - CVE House
Back to Database
Status published Medium CVE-2017-7725

concrete5 8.1.0 places incorrect trust in the HTTP Host header...

Vulnerability Description

concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored and allows for arbitrary domains to be set for certain links displayed to subsequent visitors, potentially an XSS vector.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-7725

Credits & Attribution

No credits recorded in the NVD database.

References

More from concretecms

View All →
CVE-2022-43968
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and...
Unknown 0
CVE-2022-43967
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and...
Unknown 0
CVE-2022-43695
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and...
Unknown 0
CVE-2022-43694
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and...
Unknown 0
CVE-2022-43693
Concrete CMS is vulnerable to CSRF due to the lack...
Unknown 0

Affected Vendor

concretecms

View all reports →

Affected Software

concrete cms
Vulnerable Versions:
8.1.0

Timeline

Official Publish: April 13th, 2017
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.