PT-2022-27005 · Unknown · Concrete Cms

Adrian Tiron + 1 · Published 2022-11-14 · Updated 2025-04-30 · CVE-2022-43689

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Concrete CMS (formerly concrete5) versions below 8.5.10 Concrete CMS (formerly concrete5) versions 9.0.0 through 9.1.2

Description The issue allows for XXE based DNS requests, which can lead to IP disclosure. This occurs due to a vulnerability in the Concrete CMS software, where an attacker can exploit the XML External Entity (XXE) feature to make unauthorized DNS requests, potentially revealing the IP address of the system.

Recommendations For versions below 8.5.10, update to version 8.5.10 or later. For versions 9.0.0 through 9.1.2, update to version 9.1.3 or later.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2022-43689

GHSA-Q48R-XG9H-78M8

Affected Products

Concrete Cms

References · 12

• https://github.com/concretecms/concretecms/releases/9.1.3 · Vendor Advisory
• https://github.com/concretecms/concretecms/releases/8.5.10 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q48r-xg9h-78m8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43689 · Security Note
• https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes · Vendor Advisory
• https://concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31 · Vendor Advisory
• https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-43689 · Vendor Advisory
• https://github.com/concretecms/concretecms · Note
• https://t.me/cibsecurity/52985 · Telegram Post
• https://t.me/cvenotify/37687 · Telegram Post
• https://t.me/cvenotify/120347 · Telegram Post