CVE-2022-21829 (GCVE-0-2022-21829)
Vulnerability from cvelistv5
Published
2022-06-24 15:00
Modified
2024-08-03 02:53
Severity ?
CWE
  • CWE-319 - Cleartext Transmission of Sensitive Information ()
Summary
Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing ‘concrete_secure’ instead of ‘concrete’. Concrete now only makes requests over https even a request comes in via http. Concrete CMS security team ranked this 8 with CVSS v3.1 vector: AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Credit goes to Anna for reporting HackerOne 1482520.
References
support@hackerone.comhttps://documentation.concretecms.org/developers/introduction/version-history/858-release-notesRelease Notes, Vendor Advisory
support@hackerone.comhttps://documentation.concretecms.org/developers/introduction/version-history/910-release-notes%2C
support@hackerone.comhttps://hackerone.com/reports/1482520%2C
af854a3a-2127-422b-91ae-364da2661108https://documentation.concretecms.org/developers/introduction/version-history/858-release-notesRelease Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes%2C
af854a3a-2127-422b-91ae-364da2661108https://hackerone.com/reports/1482520%2C
Impacted products
Vendor Product Version
n/a https://github.com/concrete5/concrete5 Version: Remediated in Concrete CMS 8.5.8 and 9.1.0. Affected Versions are Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:53:36.288Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/1482520%2C"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes%2C"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "https://github.com/concrete5/concrete5",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Remediated in Concrete CMS 8.5.8 and 9.1.0.    Affected Versions are Concrete 8.5.7 and below  as well as Concrete 9.0 through 9.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing \u2018concrete_secure\u2019 instead of \u2018concrete\u2019. Concrete now only makes requests over https even a request comes in via http. Concrete CMS security team ranked this 8 with CVSS v3.1 vector: AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Credit goes to Anna for reporting HackerOne 1482520."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-319",
              "description": "Cleartext Transmission of Sensitive Information (CWE-319)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-06-24T15:00:05",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/1482520%2C"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes%2C"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "ID": "CVE-2022-21829",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "https://github.com/concrete5/concrete5",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Remediated in Concrete CMS 8.5.8 and 9.1.0.    Affected Versions are Concrete 8.5.7 and below  as well as Concrete 9.0 through 9.0.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing \u2018concrete_secure\u2019 instead of \u2018concrete\u2019. Concrete now only makes requests over https even a request comes in via http. Concrete CMS security team ranked this 8 with CVSS v3.1 vector: AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Credit goes to Anna for reporting HackerOne 1482520."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cleartext Transmission of Sensitive Information (CWE-319)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes",
              "refsource": "MISC",
              "url": "https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes"
            },
            {
              "name": "https://hackerone.com/reports/1482520,",
              "refsource": "MISC",
              "url": "https://hackerone.com/reports/1482520,"
            },
            {
              "name": "https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes,",
              "refsource": "MISC",
              "url": "https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes,"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2022-21829",
    "datePublished": "2022-06-24T15:00:05",
    "dateReserved": "2021-12-10T00:00:00",
    "dateUpdated": "2024-08-03T02:53:36.288Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-21829\",\"sourceIdentifier\":\"support@hackerone.com\",\"published\":\"2022-06-24T15:15:10.143\",\"lastModified\":\"2024-11-21T06:45:31.127\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing \u2018concrete_secure\u2019 instead of \u2018concrete\u2019. Concrete now only makes requests over https even a request comes in via http. Concrete CMS security team ranked this 8 with CVSS v3.1 vector: AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Credit goes to Anna for reporting HackerOne 1482520.\"},{\"lang\":\"es\",\"value\":\"Concrete CMS versiones 9.0.0 a 9.0.2 y 8.5.7, pueden descargar archivos zip a trav\u00e9s de HTTP y ejecutar c\u00f3digo desde esos archivos zip, lo que podr\u00eda conllevar a un RCE. Corregido al aplicar \\\"concrete_secure\\\" en lugar de \\\"concrete\\\". Concrete ahora s\u00f3lo hace peticiones sobre https incluso si una petici\u00f3n entra por medio de http. El equipo de seguridad de Concrete CMS clasific\u00f3 este 8 con el vector CVSS v3.1: AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H El m\u00e9rito es de Anna por informar a HackerOne 1482520\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"support@hackerone.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-319\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-319\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"8.5.8\",\"matchCriteriaId\":\"D821B974-A48F-4925-B849-55AC51A0BE0A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.0.0\",\"versionEndExcluding\":\"9.1.0\",\"matchCriteriaId\":\"E6E5829D-AFD1-4C1B-9E53-400D09956577\"}]}]}],\"references\":[{\"url\":\"https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes\",\"source\":\"support@hackerone.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes%2C\",\"source\":\"support@hackerone.com\"},{\"url\":\"https://hackerone.com/reports/1482520%2C\",\"source\":\"support@hackerone.com\"},{\"url\":\"https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes%2C\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://hackerone.com/reports/1482520%2C\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.