Not rated
CVE-2021-22950 Concrete CMS prior to 8.5.6 had a CSFR vulnerability allowing attachments to comments in the conversation section to…
Description
Concrete CMS prior to 8.5.6 had a CSFR vulnerability allowing attachments to comments in the conversation section to be deleted.Credit for discovery: "Solar Security Research Team"
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| https://github.com/concrete5/concrete5 | Versions not published |
References
- documentation.concretecms.org documentation.concretecms.org
- hackerone.com hackerone.com
Timeline
- Published
- Last modified
Other CVEs of https://github.com/concrete5/concrete5
The 16 CVEs of https://github.com/concrete5/concrete5 →
CVE-2022-30118
Title for CVE: XSS in /dashboard/system/express/entities/forms/save_control/[GUID]: old browsers only.Description:…
Not rated
CVE-2022-30120
XSS in /dashboard/blocks/stacks/view_details/ - old browsers only
Not rated
CVE-2022-21829
Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from…
Not rated
CVE-2022-30117
Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload…
Not rated