PT-2021-22810 · Unknown · Concrete Cms

S1Lky · Published 2021-11-30 · Updated 2022-05-24 · CVE-2021-40101

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 8.5.7

Description The issue allows a user's password to be changed without prompting for the current password in the Dashboard.

Recommendations For versions prior to 8.5.7, update to version 8.5.7 or later to resolve the issue.

Exploit

Fix

XSS

Incorrect Permission

Weakness Enumeration

CWE-79

CWE-732

Related Identifiers

CVE-2021-40101

GHSA-7388-7VQ2-M4F4

Affected Products

Concrete Cms

References · 10

• 🔥 https://github.com/S1lkys/CVE-2021-40101 · Exploit
• https://osv.dev/vulnerability/CVE-2021-40101 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40101 · Security Note
• https://osv.dev/vulnerability/GHSA-7388-7vq2-m4f4 · Vendor Advisory
• https://documentation.concretecms.org/developers/introduction/version-history/857-release-notes · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28145 · Security Note
• https://t.me/cibsecurity/33134 · Telegram Post
• https://documentation.concrete5.org/developers/introduction/version-history/855-release-notes · Note
• https://concrete5.org/developers/security · Note
• https://hackerone.com/reports/1065577 · Note