GHSA-m2v2-8227-59f5Medium

Exposure of sensitive information in concrete5/core

Published
November 23, 2021
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-22967 →

📋 Description

In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message in "add / edit message”.

🎯 Affected products1

  • composer/concrete5/core:< 8.5.7

🔗 References (4)