CVE-2022-21829 — CRITICAL (9.8)

Q: How severe is CVE-2022-21829?

CVE-2022-21829 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Q: Is there a patch for CVE-2022-21829?

Check the references section above for vendor advisories and patch information. Affected products include: Concretecms Concrete Cms.

Vulnerability Description

Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing ‘concrete_secure’ instead of ‘concrete’. Concrete now only makes requests over https even a request comes in via http. Concrete CMS security team ranked this 8 with CVSS v3.1 vector: AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Credit goes to Anna for reporting HackerOne 1482520.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Concretecms	Concrete Cms	< 8.5.8

Related Weaknesses (CWE)

CWE-319

References

FAQ

What is CVE-2022-21829?

CVE-2022-21829 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing ‘concrete_secure’ in...

How severe is CVE-2022-21829?

CVE-2022-21829 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2022-21829?

Check the references section above for vendor advisories and patch information. Affected products include: Concretecms Concrete Cms.