Concretecms vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2023-48648 Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions.Critical 9.8 · Nov 16, 2023
• CVE-2022-43693 Concrete CMS is vulnerable to CSRF due to the lack of "State" parameter for external Concrete authentication service for users of Concrete who use the "out of tHigh 8.8 · Nov 14, 2022
• CVE-2022-30117 Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File DeleCritical 9.1 · Jun 24, 2022
• CVE-2022-21829 Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE.Critical 9.8 · Jun 24, 2022
• CVE-2021-22954 A cross-site request forgery vulnerability exists in Concrete CMS <v9 that could allow an attacker to make requests on behalf of other users.High 8.8 · Feb 9, 2022
• CVE-2021-40101 An issue was discovered in Concrete CMS before 8.5.7.High 7.2 · Nov 30, 2021
• CVE-2021-22970 Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable toa.High 7.5 · Nov 19, 2021
• CVE-2021-22968 A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concrete5) versions 8.5.6 anHigh 7.2 · Nov 19, 2021
• CVE-2021-22967 In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To reHigh 7.5 · Nov 19, 2021
• CVE-2021-22966 Privilege escalation from Editor to Admin using Groups in Concrete CMS versions 8.5.6 and below.High 8.8 · Nov 19, 2021
• CVE-2021-22951 Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5) prior to version 8.5.7.High 7.5 · Nov 19, 2021
• CVE-2021-22958 A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in placeCritical 9.8 · Oct 7, 2021
• CVE-2021-40108 An issue was discovered in Concrete CMS through 8.5.5.High 8.8 · Sep 27, 2021
• CVE-2021-40104 An issue was discovered in Concrete CMS through 8.5.5.High 7.5 · Sep 27, 2021
• CVE-2021-40103 An issue was discovered in Concrete CMS through 8.5.5.High 7.5 · Sep 27, 2021
• CVE-2021-40098 An issue was discovered in Concrete CMS through 8.5.5.Critical 9.8 · Sep 27, 2021
• CVE-2021-40097 An issue was discovered in Concrete CMS through 8.5.5.High 8.8 · Sep 27, 2021
• CVE-2021-40102 An issue was discovered in Concrete CMS through 8.5.5.Critical 9.1 · Sep 24, 2021
• CVE-2021-40099 An issue was discovered in Concrete CMS through 8.5.5.High 7.2 · Sep 24, 2021
• CVE-2021-36766 Concrete5 through 8.5.5 deserializes Untrusted Data.High 7.2 · Jul 30, 2021
• CVE-2020-24986 Concrete5 up to and including 8.5.2 allows Unrestricted Upload of File with Dangerous Type such as a .php file via File Manager.High 7.2 · Sep 4, 2020
• CVE-2020-11476 Concrete5 before 8.5.3 allows Unrestricted Upload of File with Dangerous Type such as a .phar file.High 7.2 · Jul 28, 2020
• CVE-2018-13790 A Server Side Request Forgery (SSRF) vulnerability in tools/files/importers/remote.php in concrete5 8.2.0 can lead to attacks on the local network and mapping oHigh 7.2 · Jul 9, 2018
• CVE-2015-4724 SQL injection vulnerability in Concrete5 5.7.3.1.High 8.8 · Sep 7, 2017