CVE-2022-21829CWE-319

CVE-2022-21829: falha em https://github.com/concrete5/concrete5

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar https://github.com/concrete5/concrete5+ Monitorar concrete5/core

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 1.8%
Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing ‘concrete_secure’ instead of ‘concrete’. Concrete now only makes requests over https even a request comes in via http. Concrete CMS security team ranked this 8 with CVSS v3.1 vector: AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Credit goes to Anna for reporting HackerOne 1482520.
Produtos afetados
n/a · https://github.com/concrete5/concrete5