GHSA-3jxh-6635-6jwp

    Dashboard / Vulnerabilities / GHSA-3jxh-6635-6jwp

    GHSA-3jxh-6635-6jwp

    Published: 25 Jun 2022Last Modified: 8 Nov 2023

    Summary: Path traversal in Concrete CMS

    Details: Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete doesn’t allow traversal and by changing isFullChunkFilePresent to have an early false return when input doesn't match expectations.Concrete CMS Security team ranked this 5.8 with CVSS v3.1 vector AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H. Credit to Siebene for reporting.

    References: https://nvd.nist.gov/vuln/detail/CVE-2022-30117, https://hackerone.com/reports/1482280, https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes, https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes, https://github.com/concretecms/concretecms-core

    Affected packages

    Package

    Name: concrete5/core

    Purl: pkg:composer/concrete5/core

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 9.0.0
    Fixed -9.1.0

    Affected versions

    9.0.0
    9.0.1
    9.0.2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-3jxh-6635-6jwp | CVE-DB