Vulnerability · Published Jun 24, 2022 · Assigned by hackerone
CVE-2022-21829
Critical 9.8
In plain English
A critical-severity security flaw in https://github.com/concrete5/concrete5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 78% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing ‘concrete_secure’ instead of ‘concrete’. Concrete now only makes requests over https even a request comes in via http. Concrete CMS security team ranked this 8 with CVSS v3.1 vector: AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Credit goes to Anna for reporting HackerOne 1482520.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | concrete5/core | 9.1.0 | GHSA-6xc4-7fmm-65q2 |
| Packagist | concrete5/core | 8.5.8 | GHSA-6xc4-7fmm-65q2 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | https://github.com/concrete5/concrete5 | Remediated in Concrete CMS 8.5.8 and 9.1.0. Affected Versions are Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 |
Weakness: CWE-319