# concrete5/core (Packagist) vulnerabilities

9 known vulnerabilities, with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/concrete5/core

## Advisories (9)

### [CVE-2022-30120](https://cve.now/CVE-2022-30120): XSS in /dashboard/blocks/stacks/view\_details/ - old browsers only.

- Severity: Unrated
- Published: Jun 24, 2022
- Affected: from 9.0.0, fixed in 9.1.0; fixed in 8.5.8.

### [CVE-2022-21829](https://cve.now/CVE-2022-21829): Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which…

- Severity: Unrated
- Published: Jun 24, 2022
- Affected: from 9.0.0, fixed in 9.1.0; fixed in 8.5.8.

### [CVE-2022-30117](https://cve.now/CVE-2022-30117): Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in…

- Severity: Unrated
- Published: Jun 24, 2022
- Affected: from 9.0.0, fixed in 9.1.0; fixed in 8.5.8.

### [CVE-2021-22968](https://cve.now/CVE-2021-22968): A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS…

- Severity: Unrated
- Published: Nov 19, 2021
- Affected: fixed in 8.5.7.

### [CVE-2021-22967](https://cve.now/CVE-2021-22967): In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message…

- Severity: Unrated
- Published: Nov 19, 2021
- Affected: fixed in 8.5.7.

### [CVE-2021-22951](https://cve.now/CVE-2021-22951): Unauthorized individuals could view password protected files using view\_inline in Concrete CMS (previously concrete 5) prior to version…

- Severity: Unrated
- Published: Nov 19, 2021
- Affected: fixed in 8.5.7.

### [CVE-2021-22966](https://cve.now/CVE-2021-22966): Privilege escalation from Editor to Admin using Groups in Concrete CMS versions 8.5.6 and below.

- Severity: Unrated
- Published: Nov 19, 2021
- Affected: fixed in 8.5.7.

### [CVE-2021-22970](https://cve.now/CVE-2021-22970): Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable…

- Severity: Unrated
- Published: Nov 19, 2021
- Affected: fixed in 8.5.7.

### [CVE-2021-22969](https://cve.now/CVE-2021-22969): Concrete CMS (formerly concrete5) versions below 8.5.7 has a SSRF mitigation bypass using DNS Rebind attack giving an attacker the ability…

- Severity: Unrated
- Published: Nov 19, 2021
- Affected: fixed in 8.5.7.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/concrete5/core
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.