GitHub Advisoryadvisory · Packagist

GHSA-6xc4-7fmm-65q2 Code injection in concrete CMS

HIGH Published 2022-06-25 Modified 2022-07-06 Official page ↗
Aliases
CVE-2022-21829
Ecosystem
Packagist
Packages
concrete5/core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-319, CWE-74
Reviewed
2022-06-29

Affected packages

• Packagist concrete5/core: >= 9.0.0, < 9.1.0 → fixed in 9.1.0 • Packagist concrete5/core: < 8.5.8 → fixed in 8.5.8

Description

Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing ‘concrete_secure’ instead of ‘concrete’. Concrete now only makes requests over https even a request comes in via http. Concrete CMS security team ranked this 8 with CVSS v3.1 vector: AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Credit goes to Anna for reporting HackerOne 1482520.

Related

Alias · CVE (1)

  • CVE-2022-21829 Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which… vulnerability

Weakness · CWE (2)

  • CWE-319 Cleartext Transmission of Sensitive Information weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References