Vulnerabilities (CVE)

Filtered by vendor Concretecms Subscribe
Filtered by product Concrete Cms
Total 87 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2021-22966 1 Concretecms 1 Concrete Cms 2024-11-21 6.5 MEDIUM 8.8 HIGH
Privilege escalation from Editor to Admin using Groups in Concrete CMS versions 8.5.6 and below. If a group is granted "view" permissions on the bulkupdate page, then users in that group can escalate to being an administrator with a specially crafted curl. Fixed by adding a check for group permissions before allowing a group to be moved. Concrete CMS Security team CVSS scoring: 7.1 AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:HCredit for discovery: "Adrian Tiron from FORTBRIDGE ( https://www.fortbridge.co.uk/ )"This fix is also in Concrete version 9.0.0
CVE-2021-22958 1 Concretecms 1 Concrete Cms 2024-11-21 7.5 HIGH 9.8 CRITICAL
A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.CVSSv2.0 AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
CVE-2021-22954 1 Concretecms 1 Concrete Cms 2024-11-21 6.8 MEDIUM 8.8 HIGH
A cross-site request forgery vulnerability exists in Concrete CMS <v9 that could allow an attacker to make requests on behalf of other users.
CVE-2021-22953 1 Concretecms 1 Concrete Cms 2024-11-21 5.8 MEDIUM 5.4 MEDIUM
A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to clone topics which can lead to UI inconvenience, and exhaustion of disk space.Credit for discovery: "Solar Security Research Team"
CVE-2021-22951 1 Concretecms 1 Concrete Cms 2024-11-21 5.0 MEDIUM 7.5 HIGH
Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5) prior to version 8.5.7. Concrete CMS now checks to see if a file has a password in view_inline and, if it does, the file is not rendered.For version 8.5.6, the following mitigations were put in place a. restricting file types for view_inline to images only b. putting a warning in the file manager to advise users.Credit for discovery: "Solar Security Research Team"Concrete CMS security team CVSS scoring is 5.3: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NThis fix is also in Concrete version 9.0.0
CVE-2021-22950 1 Concretecms 1 Concrete Cms 2024-11-21 4.3 MEDIUM 6.5 MEDIUM
Concrete CMS prior to 8.5.6 had a CSFR vulnerability allowing attachments to comments in the conversation section to be deleted.Credit for discovery: "Solar Security Research Team"
CVE-2021-22949 1 Concretecms 1 Concrete Cms 2024-11-21 5.8 MEDIUM 5.4 MEDIUM
A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to duplicate files which can lead to UI inconvenience, and exhaustion of disk space.Credit for discovery: "Solar Security CMS Research Team"
CVE-2020-24986 1 Concretecms 1 Concrete Cms 2024-11-21 9.0 HIGH 7.2 HIGH
Concrete5 up to and including 8.5.2 allows Unrestricted Upload of File with Dangerous Type such as a .php file via File Manager. It is possible to modify site configuration to upload the PHP file and execute arbitrary commands.
CVE-2020-14961 1 Concretecms 1 Concrete Cms 2024-11-21 5.0 MEDIUM 5.3 MEDIUM
Concrete5 before 8.5.3 does not constrain the sort direction to a valid asc or desc value.
CVE-2020-11476 1 Concretecms 1 Concrete Cms 2024-11-21 9.0 HIGH 7.2 HIGH
Concrete5 before 8.5.3 allows Unrestricted Upload of File with Dangerous Type such as a .phar file.
CVE-2018-19146 1 Concretecms 1 Concrete Cms 2024-11-21 3.5 LOW 4.8 MEDIUM
Concrete5 8.4.3 has XSS because config/concrete.php allows uploads (by administrators) of SVG files that may contain HTML data with a SCRIPT element.
CVE-2018-13790 1 Concretecms 1 Concrete Cms 2024-11-21 6.5 MEDIUM 7.2 HIGH
A Server Side Request Forgery (SSRF) vulnerability in tools/files/importers/remote.php in concrete5 8.2.0 can lead to attacks on the local network and mapping of the internal network, because of URL functionality on the File Manager page.
CVE-2017-8082 1 Concretecms 1 Concrete Cms 2024-11-21 4.3 MEDIUM 6.5 MEDIUM
concrete5 8.1.0 has CSRF in Thumbnail Editor in the File Manager, which allows remote attackers to disable the entire installation by merely tricking an admin into viewing a malicious page involving the /tools/required/files/importers/imageeditor?fID=1&imgData= URI. This results in a site-wide denial of service making the site not accessible to any users or any administrators.
CVE-2017-7725 1 Concretecms 1 Concrete Cms 2024-11-21 4.3 MEDIUM 6.1 MEDIUM
concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored and allows for arbitrary domains to be set for certain links displayed to subsequent visitors, potentially an XSS vector.
CVE-2017-18195 1 Concretecms 1 Concrete Cms 2024-11-21 5.0 MEDIUM 5.3 MEDIUM
An issue was discovered in tools/conversations/view_ajax.php in Concrete5 before 8.3.0. An unauthenticated user can enumerate comments from all blog posts by POSTing requests to /index.php/tools/required/conversations/view_ajax with incremental 'cnvID' integers.
CVE-2015-4724 1 Concretecms 1 Concrete Cms 2024-11-21 6.5 MEDIUM 8.8 HIGH
SQL injection vulnerability in Concrete5 5.7.3.1.
CVE-2015-4721 1 Concretecms 1 Concrete Cms 2024-11-21 4.3 MEDIUM 6.1 MEDIUM
Multiple cross-site scripting (XSS) vulnerabilities in Concrete5 5.7.3.1.
CVE-2014-9526 2 Concrete5, Concretecms 2 Concrete5, Concrete Cms 2024-11-21 4.3 MEDIUM N/A
Multiple cross-site scripting (XSS) vulnerabilities in concrete5 5.7.2.1, 5.7.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gName parameter in single_pages/dashboard/users/groups/bulkupdate.php or (2) instance_id parameter in tools/dashboard/sitemap_drag_request.php.
CVE-2014-5108 2 Concrete5, Concretecms 2 Concrete5, Concrete Cms 2024-11-21 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in single_pages\download_file.php in concrete5 before 5.6.3 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to index.php/download_file.
CVE-2014-5107 2 Concrete5, Concretecms 2 Concrete5, Concrete Cms 2024-11-21 5.0 MEDIUM N/A
concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a direct request to (1) system/basics/editor.php, (2) system/view.php, (3) system/environment/file_storage_locations.php, (4) system/mail/importers.php, (5) system/mail/method.php, (6) system/permissions/file_types.php, (7) system/permissions/files.php, (8) system/permissions/tasks.php, (9) system/permissions/users.php, (10) system/seo/view.php, (11) view.php, (12) users/attributes.php, (13) scrapbook/view.php, (14) pages/attributes.php, (15) files/attributes.php, or (16) files/search.php in single_pages/dashboard/.