Not rated
CVE-2021-22967 In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If…
Description
In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message in "add / edit message”.Concrete CMS security team gave this a CVSS v3.1 score of 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCredit for discovery Adrian H
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| https://github.com/concrete5/concrete5 | Versions not published |
References
- documentation.concretecms.org documentation.concretecms.org
- hackerone.com hackerone.com
Timeline
- Published
- Last modified
Other CVEs of https://github.com/concrete5/concrete5
The 16 CVEs of https://github.com/concrete5/concrete5 →
CVE-2022-30118
Title for CVE: XSS in /dashboard/system/express/entities/forms/save_control/[GUID]: old browsers only.Description:…
Not rated
CVE-2022-30120
XSS in /dashboard/blocks/stacks/view_details/ - old browsers only
Not rated
CVE-2022-21829
Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from…
Not rated
CVE-2022-30119
XSS in /dashboard/reports/logs/view - old browsers only
Not rated