要点
- CVE-2026-2994 是影响 concrete5/concrete5, concrete cms (concretecms) 的中危 (CVSS 6.8)漏洞。
- 未来 30 天内被利用的概率（EPSS）：0.24%，高于 14.8% 的漏洞。
- 修复：升级到 9.4.8 或更高版本。
Description
Concrete CMS below version 9.4.8 is subject to CSRF by a Rogue Administrator using the Anti-Spam Allowlist Group Configuration via group_id parameter which can leads to a security bypass since changes are saved prior to checking the CSRF token.
The Concrete CMS security team thanks z3rco for reporting
NVD description
Concrete CMS below version 9.4.8 is subject to CSRF by a Rogue Administrator using the Anti-Spam Allowlist Group Configuration via group_id parameter which can leads to a security bypass since changes are saved prior to checking the CSRF token. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks z3rco for reporting
concrete5/concrete5 的其他漏洞
查看全部 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free