Riskcovery

CVE-2021-22967

State
Published
Severity
Not scored
Published
Nov 19, 2021
Updated
Aug 3, 2024
Reserved
Jan 6, 2021

Read the record on cve.org

Description

In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message in "add / edit message”.Concrete CMS security team gave this a CVSS v3.1 score of 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCredit for discovery Adrian H

Scores

The record has no CVSS score.

Weaknesses

  • CWE-639 Insecure Direct Object Reference (IDOR) (CWE-639)

Affected Products

ProductVersions
https://github.com/concrete5/concrete5n/a
  • Affected version - Concrete 8.5.6 and below. Fixed version 9.0 and 8.5.7Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.