CVE-2021-36766
Concrete5 through 8.5.5 deserializes Untrusted Data.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.68%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Concrete5 through 8.5.5 deserializes Untrusted Data. The vulnerable code is located within the controllers/single_page/dashboard/system/environment/logging.php Logging::update_logging() method. User input passed through the logFile request parameter is not properly sanitized before being used in a call to the file_exists() PHP function. This can be exploited by malicious users to inject arbitrary PHP objects into the application scope (PHP Object Injection via phar:// stream wrapper), allowing them to carry out a variety of attacks, such as executing arbitrary PHP code.
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 3.68% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-502
- Affected
- concretecms/concrete cms
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/163564/Concrete5-8.5.5-Phar-Deserialization.htmlExploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2021/Jul/36Exploit, Mailing List, Third Party Advisory
- https://hackerone.com/reports/1063039Permissions Required, Third Party Advisory
- http://packetstormsecurity.com/files/163564/Concrete5-8.5.5-Phar-Deserialization.htmlExploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2021/Jul/36Exploit, Mailing List, Third Party Advisory
- https://hackerone.com/reports/1063039Permissions Required, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.