CVE-2017-7725 describes a Host header injection vulnerability in concrete5 CMS version 8.1.0, affecting instances where a canonical URL was not explicitly configured during installation. This flaw allows remote attackers to inject arbitrary domain names into cached links, potentially leading to Cross-Site Scripting (XSS) for subsequent visitors. Rated as Medium severity with a CVSS score of 6.1, the attack requires no privileges and low complexity, but user interaction is needed. While not listed on CISA's KEV catalog and lacking Metasploit/Nuclei modules, an exploit is publicly available on ExploitDB, though there is minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
8.1.0CPE matchmatch criteria | cpe:2.3:a:concretecms:concrete_cms:8.1.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.