PT-2022-27007 · Unknown · Concrete Cms

Adrian Tiron + 1 · Published 2022-11-14 · Updated 2025-04-30 · CVE-2022-43691

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Concrete CMS (formerly concrete5) versions below 8.5.10 Concrete CMS (formerly concrete5) versions between 9.0.0 and 9.1.2

Description The issue inadvertently discloses server-side sensitive information, including secrets in environment variables and server information, when Debug Mode is left on in production.

Recommendations For Concrete CMS (formerly concrete5) versions below 8.5.10, update to version 8.5.10 or later to resolve the issue. For Concrete CMS (formerly concrete5) versions between 9.0.0 and 9.1.2, update to version 9.1.3 or later to resolve the issue. As a temporary workaround, consider disabling Debug Mode in production environments until a patch is applied.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2022-43691

GHSA-Q3HQ-HM5H-QRX3

Affected Products

Concrete Cms

References · 12

• https://github.com/concretecms/concretecms/releases/9.1.3 · Vendor Advisory
• https://github.com/concretecms/concretecms/releases/8.5.10 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43691 · Security Note
• https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes · Vendor Advisory
• https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes · Vendor Advisory
• https://concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-43691 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q3hq-hm5h-qrx3 · Vendor Advisory
• https://github.com/concretecms/concretecms · Note
• https://t.me/cvenotify/120349 · Telegram Post
• https://t.me/cvenotify/37957 · Telegram Post
• https://t.me/cvenotify/37686 · Telegram Post