GitHub Advisoryadvisory · Packagist

GHSA-pj76-75cm-3552 Concrete CMS (previously concrete5) is vulnerable to possible auth bypass in the jobs section

CRITICAL Published 2023-04-28 Modified 2023-11-22 Official page ↗
Aliases
CVE-2023-28473
Ecosystem
Packagist
Packages
concrete5/concrete5
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287
Reviewed
2023-05-01

Affected packages

• Packagist concrete5/concrete5: < 9.2.0 → fixed in 9.2.0

Description

Concrete CMS (previously concrete5) before 9.2 is vulnerable to possible Auth bypass in the jobs section.

Related

Alias · CVE (1)

  • CVE-2023-28473 Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible Auth bypass in the jobs… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References