GitHub Advisoryadvisory · Packagist

GHSA-m2v2-8227-59f5 Exposure of sensitive information in concrete5/core

MEDIUM Published 2021-11-23 Modified 2021-11-24 Official page ↗
Aliases
CVE-2021-22967
Ecosystem
Packagist
Packages
concrete5/core
Severity
Moderate
Weaknesses
CWE-200, CWE-639
Reviewed
2021-11-22

Affected packages

• Packagist concrete5/core: < 8.5.7 → fixed in 8.5.7

Description

In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message in "add / edit message”.

Related

Alias · CVE (1)

  • CVE-2021-22967 In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References