Aller au contenu
en Se connecter
Non notée

CVE-2021-22951 Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5)…

Description

Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5) prior to version 8.5.7. Concrete CMS now checks to see if a file has a password in view_inline and, if it does, the file is not rendered.For version 8.5.6, the following mitigations were put in place a. restricting file types for view_inline to images only b. putting a warning in the file manager to advise users.Credit for discovery: "Solar Security Research Team"Concrete CMS security team CVSS scoring is 5.3: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NThis fix is also in Concrete version 9.0.0

Produits et versions touchés

Produit Versions touchées Corrigé en
https://github.com/concrete5/concrete5 Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de https://github.com/concrete5/concrete5

Les 16 CVE de https://github.com/concrete5/concrete5 →
CVE-2022-30118 Title for CVE: XSS in /dashboard/system/express/entities/forms/save_control/[GUID]: old browsers only.Description:… Non notée CVE-2022-30120 XSS in /dashboard/blocks/stacks/view_details/ - old browsers only Non notée CVE-2022-21829 Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from… Non notée CVE-2022-30117 Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload… Non notée
Suivre cette CVE