Lucene search
Veracode Vulnerability DatabaseVERACODE:33093HistoryNov 25, 2021 - 6:48 a.m.
Information Disclosure
2021-11-2506:48:33
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
7
0.002 Low
EPSS
Percentile
52.9%
concrete5/concrete5 is vulnerable to information disclosure. The vulnerability exists due to an insecure indirect object reference, allowing an attacker to access restricted files by attaching a message to the conversation.
References
documentation.concretecms.org/developers/introduction/version-history/857-release-notes
github.com/advisories/GHSA-m2v2-8227-59f5
github.com/concrete5/concrete5-core/commit/8b3ea9c1768078814f2218c0b6c2ddf144c3e072
github.com/concrete5/concrete5/commit/0ff0bb95eaa4644b52d4cbb0aa9980c7feb9faab
hackerone.com/reports/869612
Related
osv
osv
Exposure of sensitive information in concrete5/core
2021-11-23 17:54:39
cnvd
cnvd
PortlandLabs Concrete CMS has an unspecified vulnerability (CNVD-2021-94040)
2021-11-23 00:00:00
nvd
nvd
CVE-2021-22967
2021-11-19 19:15:08
cvelist
cvelist
CVE-2021-22967
2021-11-19 18:11:07
github
github
Exposure of sensitive information in concrete5/core
2021-11-23 17:54:39
cve
cve
CVE-2021-22967
2021-11-19 19:15:08
prion
prion
Design/Logic Flaw
2021-11-19 19:15:00
openvas
openvas
Concrete CMS < 8.5.7 Multiple Vulnerabilities
2021-11-22 00:00:00