CVE-2022-30117

Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete doesn’t allow traversal and by changing isFullChunkFilePresent to have an early false return when input doesn't match expectations.Concrete CMS Security team ranked this 5.8 with CVSS v3.1 vector AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H. Credit to Siebene for reporting.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*
cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:02

Type Values Removed Values Added
References () https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes - Release Notes, Vendor Advisory () https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes - Release Notes, Vendor Advisory
References () https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes - Release Notes, Vendor Advisory () https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes - Release Notes, Vendor Advisory
References () https://hackerone.com/reports/1482280 - Permissions Required, Third Party Advisory () https://hackerone.com/reports/1482280 - Permissions Required, Third Party Advisory

05 Jul 2022, 18:05

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : 6.4
v3 : 9.1
CWE CWE-22
CPE cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*
References (MISC) https://hackerone.com/reports/1482280 - (MISC) https://hackerone.com/reports/1482280 - Permissions Required, Third Party Advisory
References (MISC) https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes - (MISC) https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes - Release Notes, Vendor Advisory
References (MISC) https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes - (MISC) https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes - Release Notes, Vendor Advisory

24 Jun 2022, 15:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-06-24 15:15

Updated : 2024-11-21 07:02


NVD link : CVE-2022-30117

Mitre link : CVE-2022-30117

CVE.ORG link : CVE-2022-30117


JSON object : View

Products Affected

concretecms

  • concrete_cms
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')