CVE-2021-22967CWE-639

In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To…

published November 19, 2021

CVSS
—
EPSS
1%
Percentile
66.5
In the wild
Unconfirmed
What it is

In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message in "add / edit message”.Concrete CMS security team gave this a CVSS v3.1 score of 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCredit for discovery Adrian H

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01146 · 66.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2021-11-19T18:11Z
EPSS history
Timeline
  • 19 NOV 18:11Z
    In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To…
    cvelistv5