Riskcovery

CVE-2022-21829

State
Published
Severity
Not scored
Published
Jun 24, 2022
Updated
Aug 3, 2024
Reserved
Dec 10, 2021

Read the record on cve.org

Description

Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing ‘concrete_secure’ instead of ‘concrete’. Concrete now only makes requests over https even a request comes in via http. Concrete CMS security team ranked this 8 with CVSS v3.1 vector: AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Credit goes to Anna for reporting HackerOne 1482520.

Scores

The record has no CVSS score.

Weaknesses

  • CWE-319 Cleartext Transmission of Sensitive Information (CWE-319)

Affected Products

ProductVersions
https://github.com/concrete5/concrete5n/a
  • Remediated in Concrete CMS 8.5.8 and 9.1.0. Affected Versions are Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.