| CVE-2021-22970 | ALTO7.5 | Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable toa. SSRF attacks on the private LAN servers by reading files from the local LAN. An attacker can pivot in the private LAN and exploit local network appsandb. SSRF Mitigation Bypass | 19/11/2021 |
| CVE-2021-22969 | MEDIO5.3 | Concrete CMS (formerly concrete5) versions below 8.5.7 has a SSRF mitigation bypass using DNS Rebind attack giving an attacker the ability to fetch cloud IAAS (ex AWS) IAM keys.To fix this Concrete CMS no longer allows downloads from the local network and specifies the validated IP when downloading rather than relying | 19/11/2021 |
| CVE-2021-22968 | ALTO7.2 | A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concrete5) versions 8.5.6 and below.The external file upload feature stages files in the public directory even if they have disallowed file extensions. They are stored in a directory with | 19/11/2021 |
| CVE-2021-22967 | ALTO7.5 | In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message in "add / edit message”.Concrete CMS secu | 19/11/2021 |
| CVE-2021-22966 | ALTO8.8 | Privilege escalation from Editor to Admin using Groups in Concrete CMS versions 8.5.6 and below. If a group is granted "view" permissions on the bulkupdate page, then users in that group can escalate to being an administrator with a specially crafted curl. Fixed by adding a check for group permissions before allowing a | 19/11/2021 |
| CVE-2021-22951 | ALTO7.5 | Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5) prior to version 8.5.7. Concrete CMS now checks to see if a file has a password in view_inline and, if it does, the file is not rendered.For version 8.5.6, the following mitigations were put in place a | 19/11/2021 |
| CVE-2021-22958 | CRÍTICO9.8 | A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.CVSSv2.0 AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N | 07/10/2021 |
| CVE-2021-40109 | MEDIO6.4 | A SSRF issue was discovered in Concrete CMS through 8.5.5. Users can access forbidden files on their local network. A user with permissions to upload files from external sites can upload a URL that redirects to an internal resource of any file type. The redirect is followed and loads the contents of the file from the r | 27/09/2021 |
| CVE-2021-40108 | ALTO8.8 | An issue was discovered in Concrete CMS through 8.5.5. The Calendar is vulnerable to CSRF. ccm_token is not verified on the ccm/calendar/dialogs/event/add/save endpoint. | 27/09/2021 |
| CVE-2021-40106 | MEDIO6.1 | An issue was discovered in Concrete CMS through 8.5.5. There is unauthenticated stored XSS in blog comments via the website field. | 27/09/2021 |
| CVE-2021-40105 | MEDIO6.1 | An issue was discovered in Concrete CMS through 8.5.5. There is XSS via Markdown Comments. | 27/09/2021 |
| CVE-2021-40104 | ALTO7.5 | An issue was discovered in Concrete CMS through 8.5.5. There is an SVG sanitizer bypass. | 27/09/2021 |
| CVE-2021-40103 | ALTO7.5 | An issue was discovered in Concrete CMS through 8.5.5. Path Traversal can lead to Arbitrary File Reading and SSRF. | 27/09/2021 |
| CVE-2021-40098 | CRÍTICO9.8 | An issue was discovered in Concrete CMS through 8.5.5. Path Traversal leading to RCE via external form by adding a regular expression. | 27/09/2021 |
| CVE-2021-40097 | ALTO8.8 | An issue was discovered in Concrete CMS through 8.5.5. Authenticated path traversal leads to to remote code execution via uploaded PHP code, related to the bFilename parameter. | 27/09/2021 |
| CVE-2021-40102 | CRÍTICO9.1 | An issue was discovered in Concrete CMS through 8.5.5. Arbitrary File deletion can occur via PHAR deserialization in is_dir (PHP Object Injection associated with the __wakeup magic method). | 24/09/2021 |
| CVE-2021-40100 | MEDIO5.4 | An issue was discovered in Concrete CMS through 8.5.5. Stored XSS can occur in Conversations when the Active Conversation Editor is set to Rich Text. | 24/09/2021 |
| CVE-2021-40099 | ALTO7.2 | An issue was discovered in Concrete CMS through 8.5.5. Fetching the update json scheme over HTTP leads to remote code execution. | 24/09/2021 |
| CVE-2021-22953 | MEDIO5.4 | A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to clone topics which can lead to UI inconvenience, and exhaustion of disk space.Credit for discovery: "Solar Security Research Team" | 23/09/2021 |
| CVE-2021-22950 | MEDIO6.5 | Concrete CMS prior to 8.5.6 had a CSFR vulnerability allowing attachments to comments in the conversation section to be deleted.Credit for discovery: "Solar Security Research Team" | 23/09/2021 |