Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS0zY3h4LTNmNTMtbTkyY84AAv4m
Concrete CMS vulnerable to Uncontrolled Resource Consumption leading to DoS
In Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2, the authTypeConcreteCookieMap table can be filled up causing a denial of service (high load).
Permalink: https://github.com/advisories/GHSA-3cxx-3f53-m92cJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zY3h4LTNmNTMtbTkyY84AAv4m
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 1 year ago
Updated: 8 months ago
CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Identifiers: GHSA-3cxx-3f53-m92c, CVE-2022-43686
References:
- https://nvd.nist.gov/vuln/detail/CVE-2022-43686
- https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes
- https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes
- https://github.com/concretecms/concretecms/releases/8.5.10
- https://github.com/concretecms/concretecms/releases/9.1.3
- https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31
- https://github.com/advisories/GHSA-3cxx-3f53-m92c
Blast Radius: 5.5
Affected Packages
packagist:concrete5/concrete5
Dependent packages: 4Dependent repositories: 7
Downloads: 2,037 total
Affected Version Ranges: >= 9.0.0, < 9.1.3, < 8.5.10
Fixed in: 9.1.3, 8.5.10
All affected versions: 8.0.1, 8.0.2, 8.0.3, 8.1.0, 8.2.0, 8.2.1, 8.3.0, 8.3.1, 8.3.2, 8.4.0, 8.4.1, 8.4.2, 8.4.3, 8.4.4, 8.4.5, 8.5.0, 8.5.1, 8.5.2, 8.5.3, 8.5.4, 8.5.5, 8.5.6, 8.5.7, 8.5.8, 8.5.9, 9.0.0, 9.0.1, 9.0.2, 9.1.0, 9.1.1, 9.1.2
All unaffected versions: 8.5.10, 8.5.11, 8.5.12, 8.5.13, 8.5.14, 8.5.15, 8.5.16, 8.5.99, 9.1.3, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.2.5, 9.2.6, 9.2.7, 9.2.8