PT-2021-22807 · Unknown · Concrete Cms

Published 2021-09-27 · Updated 2021-10-01 · CVE-2021-40098

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Concrete CMS versions through 8.5.5

Description An issue was discovered in Concrete CMS, allowing Path Traversal leading to Remote Code Execution (RCE) via an external form by adding a regular expression.

Recommendations For versions through 8.5.5, consider restricting access to external forms to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using external forms that allow regular expressions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-40098

Affected Products

Concrete Cms

References · 6

• https://documentation.concretecms.org/developers/introduction/version-history/856-release-notes · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40098 · Security Note
• https://osv.dev/vulnerability/CVE-2021-40098 · Vendor Advisory
• https://hackerone.com/reports/1102080 · Note
• https://t.me/cibsecurity/29447 · Telegram Post
• https://t.me/cvenotify/21787 · Telegram Post