MEDIUM

GHSA-m2v2-8227-59f5

Exposure of sensitive information in concrete5/core

Quick fix

GHSA-m2v2-8227-59f5 — concrete5/core: upgrade to the fixed version with the command below.

composer require concrete5/core:^8.5.7

Details

In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message in "add / edit message”.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/concrete5/core

Introduced in: 0Fixed in: 8.5.7

Fixcomposer require concrete5/core:^8.5.7

References

https://nvd.nist.gov/vuln/detail/CVE-2021-22967[ADVISORY]
https://hackerone.com/reports/869612[WEB]
https://documentation.concretecms.org/developers/introduction/version-history/857-release-notes[WEB]