CVE-2021-22967

EPSS 0.75%

Exposure of sensitive information in concrete5/core

Published: 11/23/2021Modified: 12/2/2024
Also known as:GHSA-m2v2-8227-59f5

Description

In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message in "add / edit message”.

Affected packages (1)

References (3)