PT-2022-27002 · Unknown · Concrete Cms

Adrian Tiron + 1 · Published 2022-11-14 · Updated 2025-04-30 · CVE-2022-43686

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Concrete CMS (formerly concrete5) versions 9.0.0 through 9.1.2 Concrete CMS (formerly concrete5) versions prior to 8.5.10

Description The issue allows the authTypeConcreteCookieMap table to be filled up, causing a denial of service due to high load.

Recommendations For versions prior to 8.5.10, update to version 8.5.10 or later. For versions 9.0.0 through 9.1.2, update to a version later than 9.1.2.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2022-43686

GHSA-3CXX-3F53-M92C

Affected Products

Concrete Cms

References · 13

• https://github.com/concretecms/concretecms/releases/9.1.3 · Patch
• https://github.com/concretecms/concretecms/releases/8.5.10 · Patch
• https://osv.dev/vulnerability/CVE-2022-43686 · Vendor Advisory
• https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes · Vendor Advisory
• https://concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43686 · Security Note
• https://osv.dev/vulnerability/GHSA-3cxx-3f53-m92c · Vendor Advisory
• https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes · Vendor Advisory
• https://github.com/concretecms/concretecms · Note
• https://t.me/cvenotify/120345 · Telegram Post
• https://t.me/cvenotify/38005 · Telegram Post
• https://t.me/cvenotify/37679 · Telegram Post
• https://t.me/cibsecurity/52990 · Telegram Post