VulnerabilityModified
CVE-2023-28473
Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible Auth bypass in the jobs section.
LOW 3.3EPSS 0.76%
Does this matter?
Lower severity and a low EPSS score (0.76%). Track it; it rarely justifies an emergency change on its own.
Description
Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible Auth bypass in the jobs section.
- CVSS 3.1
- 3.3 LOWCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L
- EPSS
- 0.76% probability · 53th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- concretecms/concrete cms
- Source
- cve@mitre.org
References
- https://concretecms.comProduct
- https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release
- https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20Vendor Advisory
- https://concretecms.comProduct
- https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release
- https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.