CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-22951
https://notcve.org/view.php?id=CVE-2021-22951
Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5) prior to version 8.5.7. Concrete CMS now checks to see if a file has a password in view_inline and, if it does, the file is not rendered.For version 8.5.6, the following mitigations were put in place a. restricting file types for view_inline to images only b. putting a warning in the file manager to advise users.Credit for discovery: "Solar Security Research Team"Concrete CMS security team CVSS scoring is 5.3: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NThis fix is also in Concrete version 9.0.0 Unas personas no autorizadas podían visualizar los archivos protegidos por contraseña usando la función view_inline en Concrete CMS (anteriormente concrete 5) versiones anteriores a 8.5.7. Para la versión 8.5.6, han sido implementadas las siguientes medidas de mitigación a. restringir los tipos de archivo para view_inline únicamente a las imágenes b. incluir una advertencia en el administrador de archivos para avisar a usuarios: "Solar Security Research Team "La puntuación CVSS del equipo de seguridad de CMS es de 5,3: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NTEsta corrección también está en Concrete versión 9.0.0 • https://documentation.concretecms.org/developers/introduction/version-history/857-release-notes https://hackerone.com/reports/1102014 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-22966
https://notcve.org/view.php?id=CVE-2021-22966
Privilege escalation from Editor to Admin using Groups in Concrete CMS versions 8.5.6 and below. If a group is granted "view" permissions on the bulkupdate page, then users in that group can escalate to being an administrator with a specially crafted curl. Fixed by adding a check for group permissions before allowing a group to be moved. Concrete CMS Security team CVSS scoring: 7.1 AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:HCredit for discovery: "Adrian Tiron from FORTBRIDGE ( https://www.fortbridge.co.uk/ )"This fix is also in Concrete version 9.0.0 Una escalada de privilegios de Editor a Administrador usando Grupos en Concrete CMS versiones 8.5.6 e inferiores. Si a un grupo le es concedido permisos "view" en la página de bulkupdate, entonces usuarios de ese grupo pueden escalar a ser un administrador con un curl especialmente diseñado. • https://documentation.concretecms.org/developers/introduction/version-history/857-release-notes https://hackerone.com/reports/1362747 • CWE-863: Incorrect Authorization •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-22970
https://notcve.org/view.php?id=CVE-2021-22970
Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable toa. SSRF attacks on the private LAN servers by reading files from the local LAN. An attacker can pivot in the private LAN and exploit local network appsandb. SSRF Mitigation Bypass through DNS RebindingConcrete CMS security team gave this a CVSS score of 3.5 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:NConcrete CMS is maintaining Concrete version 8.5.x until 1 May 2022 for security fixes.This CVE is shared with HackerOne Reports https://hackerone.com/reports/1364797 and https://hackerone.com/reports/1360016Reporters: Adrian Tiron from FORTBRIDGE (https://www.fortbridge.co.uk/ ) and Bipul Jaiswal Concrete CMS (antes concrete5) versiones 8.5.6 y anteriores versión 9.0.0, permiten una importación de IP locales causando que el sistema sea vulnerable a unos ataques de tipo SSRF en los servidores de la LAN privada mediante una lectura de archivos de la LAN local. Un atacante puede pivotar en la LAN privada y explotar la red local appsandb. • https://documentation.concretecms.org/developers/introduction/version-history/857-release-notes https://documentation.concretecms.org/developers/introduction/version-history/901-release-notes https://hackerone.com/reports/1364797 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-22969
https://notcve.org/view.php?id=CVE-2021-22969
Concrete CMS (formerly concrete5) versions below 8.5.7 has a SSRF mitigation bypass using DNS Rebind attack giving an attacker the ability to fetch cloud IAAS (ex AWS) IAM keys.To fix this Concrete CMS no longer allows downloads from the local network and specifies the validated IP when downloading rather than relying on DNS.Discoverer: Adrian Tiron from FORTBRIDGE ( https://www.fortbridge.co.uk/ )The Concrete CMS team gave this a CVSS 3.1 score of 3.5 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N . Please note that Cloud IAAS provider mis-configurations are not Concrete CMS vulnerabilities. A mitigation for this vulnerability is to make sure that the IMDS configurations are according to a cloud provider's best practices.This fix is also in Concrete version 9.0.0 Concrete CMS (antes concrete5) versiones anteriores a 8.5.7, presentan una omisión de mitigación de tipo SSRF usando un ataque DNS Rebind dando a un atacante la capacidad de conseguir claves IAM en la nube IAAS (ex AWS). Para corregir esto Concrete CMS ya no permite descargas desde la red local y especifica la IP comprobada cuando descarga en lugar de confiar en DNS.Discoverer: Adrian Tiron de FORTBRIDGE ( https://www.fortbridge.co.uk/ ).El equipo de Concrete CMS dio a esto una puntuación CVSS 3.1 de 3.5 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N . Por favor, tenga en cuenta que los errores de configuración de los proveedores de Cloud IAAS no son vulnerabilidades concretas de CMS. • https://documentation.concretecms.org/developers/introduction/version-history/857-release-notes https://hackerone.com/reports/1369312 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-22958
https://notcve.org/view.php?id=CVE-2021-22958
A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.CVSSv2.0 AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N Se ha encontrado una vulnerabilidad de tipo Server-Side Request Forgery en concrete5 versiones anteriores a 8.5.5, que permitía a una dirección IP codificada en notación decimal omitir las limitaciones presentes para localhost permitiendo una interacción con servicios locales. El impacto puede variar dependiendo de los servicios expuestos.CVSS:v2.0 AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N • https://documentation.concretecms.org/developers/introduction/version-history/855-release-notes https://hackerone.com/reports/863221 • CWE-918: Server-Side Request Forgery (SSRF) •