Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1tMnYyLTgyMjctNTlmNc0Xwg

Exposure of sensitive information in concrete5/core

In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message in "add / edit message”.

Permalink: https://github.com/advisories/GHSA-m2v2-8227-59f5
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tMnYyLTgyMjctNTlmNc0Xwg
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 3 years ago
Updated: almost 2 years ago

Identifiers: GHSA-m2v2-8227-59f5, CVE-2021-22967
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-22967
• https://hackerone.com/reports/869612
• https://documentation.concretecms.org/developers/introduction/version-history/857-release-notes
• https://github.com/advisories/GHSA-m2v2-8227-59f5

Blast Radius: 0.0

Affected Packages