CVE-2021-22967
EPSS 0.75%Exposure of sensitive information in concrete5/core
發布日:2021/11/23修改日:2024/12/2
描述
In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message in "add / edit message”.
受影響套件(1)
- Packagist/concrete5/corefrom 0, < 8.5.7