CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-22969
https://notcve.org/view.php?id=CVE-2021-22969
Concrete CMS (formerly concrete5) versions below 8.5.7 has a SSRF mitigation bypass using DNS Rebind attack giving an attacker the ability to fetch cloud IAAS (ex AWS) IAM keys.To fix this Concrete CMS no longer allows downloads from the local network and specifies the validated IP when downloading rather than relying on DNS.Discoverer: Adrian Tiron from FORTBRIDGE ( https://www.fortbridge.co.uk/ )The Concrete CMS team gave this a CVSS 3.1 score of 3.5 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N . Please note that Cloud IAAS provider mis-configurations are not Concrete CMS vulnerabilities. A mitigation for this vulnerability is to make sure that the IMDS configurations are according to a cloud provider's best practices.This fix is also in Concrete version 9.0.0 Concrete CMS (antes concrete5) versiones anteriores a 8.5.7, presentan una omisión de mitigación de tipo SSRF usando un ataque DNS Rebind dando a un atacante la capacidad de conseguir claves IAM en la nube IAAS (ex AWS). Para corregir esto Concrete CMS ya no permite descargas desde la red local y especifica la IP comprobada cuando descarga en lugar de confiar en DNS.Discoverer: Adrian Tiron de FORTBRIDGE ( https://www.fortbridge.co.uk/ ).El equipo de Concrete CMS dio a esto una puntuación CVSS 3.1 de 3.5 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N . Por favor, tenga en cuenta que los errores de configuración de los proveedores de Cloud IAAS no son vulnerabilidades concretas de CMS. • https://documentation.concretecms.org/developers/introduction/version-history/857-release-notes https://hackerone.com/reports/1369312 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-22958
https://notcve.org/view.php?id=CVE-2021-22958
A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.CVSSv2.0 AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N Se ha encontrado una vulnerabilidad de tipo Server-Side Request Forgery en concrete5 versiones anteriores a 8.5.5, que permitía a una dirección IP codificada en notación decimal omitir las limitaciones presentes para localhost permitiendo una interacción con servicios locales. El impacto puede variar dependiendo de los servicios expuestos.CVSS:v2.0 AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N • https://documentation.concretecms.org/developers/introduction/version-history/855-release-notes https://hackerone.com/reports/863221 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-40109
https://notcve.org/view.php?id=CVE-2021-40109
A SSRF issue was discovered in Concrete CMS through 8.5.5. Users can access forbidden files on their local network. A user with permissions to upload files from external sites can upload a URL that redirects to an internal resource of any file type. The redirect is followed and loads the contents of the file from the redirected-to server. Files of disallowed types can be uploaded. • https://documentation.concretecms.org/developers/introduction/version-history/856-release-notes https://hackerone.com/reports/1102105 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-40108
https://notcve.org/view.php?id=CVE-2021-40108
An issue was discovered in Concrete CMS through 8.5.5. The Calendar is vulnerable to CSRF. ccm_token is not verified on the ccm/calendar/dialogs/event/add/save endpoint. Se ha detectado un problema en Concrete CMS versiones hasta 8.5.5. El Calendario es vulnerable a un ataque de tipo CSRF. La función ccm_token no se verifica en el endpoint ccm/calendar/dialogs/event/add/save • https://documentation.concretecms.org/developers/introduction/version-history/856-release-notes https://hackerone.com/reports/1102018 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-40106
https://notcve.org/view.php?id=CVE-2021-40106
An issue was discovered in Concrete CMS through 8.5.5. There is unauthenticated stored XSS in blog comments via the website field. Se ha detectado un problema en Concrete CMS versiones hasta 8.5.5. Se presenta una vulnerabilidad de tipo XSS almacenado no autenticado en los comentarios del blog por medio del campo website • https://documentation.concretecms.org/developers/introduction/version-history/856-release-notes https://hackerone.com/reports/1102042 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •