Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
concrete5 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2017-7725 - Vulnerability Database
concrete5

concrete5 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2017-7725

Medium
Reference: CVE-2017-7725
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2017-7725
Title: concrete5 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Overview:

concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching if the administrator did not define a quotcanonicalquot URL on installation of concrete5 using the quotAdvanced Optionsquot settings. Remote attackers can make a GET request with any domain name in the Host header this is stored and allows for arbitrary domains to be set for certain links displayed to subsequent visitors potentially an XSS vector.