Path Traversal in Concretecms Concrete Cms
CVE-2022-30117
Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete doesn’t allow traversal and by changing isFullChunkFilePresent to have an early false return when input doesn't match expectations.Concrete CMS Security team ranked this 5.8 with CVSS v3.1 vector AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H. Credit to Siebene for reporting.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.
EPSS exploit prediction
EPSS: 0.021 (81.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 81st percentile — 81.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.021 · newest: 0.021 · change: +0.001
Affected products
- Concretecms Concrete Cms
- Https://github.com/concrete5/concrete5 — versions Remediated in Concrete CMS 8.5.8 and 9.1.0. Affected Versions are Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2
Weakness classification (CWE)
References
- hackerone.com/reports/1482280 (Permissions Required, Third Party Advisory)
- documentation.concretecms.org/developers/introduction/version-history/910-relea… (Release Notes, Vendor Advisory)
- documentation.concretecms.org/developers/introduction/version-history/858-relea… (Release Notes, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-30117?
- CVE-2022-30117 is a critical-severity vulnerability in Concretecms Concrete Cms, classified under Path Traversal. CVSS score: 9.1/10. Published 2022-06-24.
- How severe is CVE-2022-30117?
- Critical severity. CVSS v3 base score is 9.1 out of 10.