CVE-2021-36766

Katalog CVE

CVSS 7.2 · High EPSS 3,7%

Kerentanan Deserialization of Untrusted Data pada concretecms concrete cms. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

Concrete5 through 8.5.5 deserializes Untrusted Data. The vulnerable code is located within the controllers/single_page/dashboard/system/environment/logging.php Logging::update_logging() method. User input passed through the logFile request parameter is not properly sanitized before being used in a call to the file_exists() PHP function. This can be exploited by malicious users to inject arbitrary PHP objects into the application scope (PHP Object Injection via phar:// stream wrapper), allowing them to carry out a variety of attacks, such as executing arbitrary PHP code.

Rincian

Terbit di NVD

30 Juli 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

3,7% peluang dieksploitasi; lebih tinggi dari 89,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://packetstormsecurity.com/files/163564/Concrete5-8.5.5-Phar-Deserialization.html exploit · advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2021/Jul/36 exploit · mailing list · advisory pihak ketiga
• https://hackerone.com/reports/1063039 permissions required · advisory pihak ketiga