GitHub Advisoryadvisory · Packagist

GHSA-3jxh-6635-6jwp Path traversal in Concrete CMS

CRITICAL Published 2022-06-25 Modified 2022-07-06 Official page ↗
Aliases
CVE-2022-30117
Ecosystem
Packagist
Packages
concrete5/core
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-22
Reviewed
2022-06-29

Affected packages

• Packagist concrete5/core: >= 9.0.0, < 9.1.0 → fixed in 9.1.0 • Packagist concrete5/core: < 8.5.8 → fixed in 8.5.8

Description

Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete doesn’t allow traversal and by changing isFullChunkFilePresent to have an early false return when input doesn't match expectations.Concrete CMS Security team ranked this 5.8 with CVSS v3.1 vector AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H. Credit to Siebene for reporting.

Related

Alias · CVE (1)

  • CVE-2022-30117 Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References