CVE-2021-22968: Concretecms https://github.com/concrete5/concrete5 vulnerability
Concretecms · https://github.com/concrete5/concrete5
Affected: Concretecms https://github.com/concrete5/concrete5 · Exploitation: possible (1 to 10%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 88% of scored CVEs
Not scored yet. The CVE record carries no CVSS score.
DescriptionCVE.org
A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concrete5) versions 8.5.6 and below.The external file upload feature stages files in the public directory even if they have disallowed file extensions. They are stored in a directory with a random name, but it's possible to stall the uploads and brute force the directory name. You have to be an admin with the ability to upload files, but this bug gives you the ability to upload restricted file types and execute them depending on server configuration.To fix this, a check for allowed file extensions was added before downloading files to a tmp directory.Concrete CMS Security Team gave this a CVSS v3.1 score of 5.4 AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:NThis fix is also in Concrete version 9.0.0
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- https://github.com/concrete5/concrete5Concrete CMS version 9.0 and version 8.5.7
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Possible (1 to 10%). EPSS between 1% and 10%.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- Concretecms
- Published
- November 2021
- Bounty reports
- 1 disclosed on HackerOne
Disclosed bug bounty reports about CVE-2021-22968
The reports on HackerOne that name this CVE, with HackerOne's own outcome. Titles and metadata only.
- A bypass of adding remote files in concrete5 FIlemanager leads to remote code executionConcrete CMS · 2021 · medium severityValid
CoverageNo articles yet
No CyberSIXT article names CVE-2021-22968 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.