CVE-2018-13790 Server-side request forgery in n/a
An SSRF vulnerability in concrete5 allows attackers to access internal network resources and map the local network via the File Manager URL functionality.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-13790?
CVE-2018-13790 is a high-severity server-side request forgery vulnerability in Concretecms Concrete Cms, published on 9 Jul 2018. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A Server Side Request Forgery (SSRF) vulnerability in tools/files/importers/remote.php in concrete5 8.2.0 can lead to attacks on the local network and mapping of the internal network, because of URL functionality on the File Manager page.
Weakness: CWE-918
Which versions are affected by CVE-2018-13790?
It affects 1 product.
Products include Concretecms Concrete Cms.
How do I fix CVE-2018-13790?
No fix has been published for CVE-2018-13790 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2018-13790 being exploited?
There is no known exploitation of CVE-2018-13790 in the wild and no public exploit code.
Other vulnerabilities in Concretecms Concrete Cms
- CVE-2023-48648 Concrete CMS allows unauthorized access because directories can be created with insecure permissions
- CVE-2022-21829 Code injection in concrete CMS
- CVE-2021-22958 Server-Side Request Forgery vulnerability in concrete5
- CVE-2021-40098 Path traversal in n/a
- CVE-2026-8134 Concrete CMS Vulnerable to Relative Path Traversal
Sources
Also known as GHSA-hxh5-f5fj-62c3.