CVE-2022-21829

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing ‘concrete_secure’ instead of ‘concrete’. Concrete now only makes requests over https even a request comes in via http. Concrete CMS security team ranked this 8 with CVSS v3.1 vector: AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Credit goes to Anna for reporting HackerOne 1482520.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-319

Affected software

No affected versions have been published.

Timeline

Published: Jun 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-21837.8Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.CVE-2022-218306.1A blind self XSS vulnerability exists in RocketChat LiveChat <v1.9 that could allow an attacker to trick a victim pasting malicious code in CVE-2022-218319.8A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing argu CVE-2022-218337.8Virtual Machine IDE Drive Elevation of Privilege Vulnerability CVE-2022-218347.8Windows User-mode Driver Framework Reflector Driver Elevation of Privilege Vulnerability CVE-2022-218357.8Microsoft Cryptographic Services Elevation of Privilege Vulnerability CVE-2022-218367.8Windows Certificate Spoofing Vulnerability CVE-2022-218378.8Microsoft SharePoint Server Remote Code Execution Vulnerability CVE-2022-218387.8Windows Cleanup Manager Elevation of Privilege Vulnerability CVE-2022-218395.5Windows Event Tracing Discretionary Access Control List Denial of Service Vulnerability CVE-2022-21848.8The CAPTCHA 4WP WordPress plugin before 7.1.0 lets user input reach a sensitive require_once call in one of its admin-side templates. This c CVE-2022-218408.8Microsoft Office Remote Code Execution Vulnerability