Https://github.com/concrete5/concrete5 vulnerabilities
We track 2 vulnerabilities in Https://github.com/concrete5/concrete5 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on June 24, 2022.
2vulnerabilities
2critical
0high
0exploited
9.4average CVSS score
Latest Https://github.com/concrete5/concrete5 vulnerabilities
- 9.1 Critical severity
https://github.com/concrete5/concrete5: Improper Limitation of a Pathname to a Restricted Directory
Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete d
- 9.8 Critical severity
https://github.com/concrete5/concrete5: Cleartext Transmission of Sensitive Information
Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing ‘concrete_secure’ instead of ‘concrete’. Concrete now only makes requests over h