Vulnerability · Published Nov 19, 2021 · Assigned by hackerone

CVE-2021-22951

High 7.5

In plain English

A high-severity authorization bypass via user-controlled key in https://github.com/concrete5/concrete5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High

Exploit odds (30 days)1.1%top 33.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5) prior to version 8.5.7. Concrete CMS now checks to see if a file has a password in view_inline and, if it does, the file is not rendered.For version 8.5.6, the following mitigations were put in place a. restricting file types for view_inline to images only b. putting a warning in the file manager to advise users.Credit for discovery: "Solar Security Research Team"Concrete CMS security team CVSS scoring is 5.3: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NThis fix is also in Concrete version 9.0.0

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	concrete5/core	8.5.7	GHSA-rhf5-f553-xg82

Affected products (as reported)

Vendor	Product	Versions
n/a	https://github.com/concrete5/concrete5	Fixed version Concrete CMS 8.5.7 and 9.0

Weakness: CWE-639

References

https://documentation.concretecms.org/developers/introduction/version-history/857-release-notes x_refsource_MISC
https://hackerone.com/reports/1102014 x_refsource_MISC