medium6.5
CVE-2022-43686
Concrete CMS vulnerable to Uncontrolled Resource Consumption leading to DoS
Impact
In Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2, the authTypeConcreteCookieMap table can be filled up causing a denial of service (high load).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | concrete5/concrete5 | < 8.5.10 | 8.5.10 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Concretecms | Concrete Cms | before 8.5.10 from 9.0.0 through 9.1.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes
- https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes
- https://github.com/concretecms/concretecms/releases/8.5.10
- https://github.com/concretecms/concretecms/releases/9.1.3
- https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31
- https://github.com/advisories/GHSA-3cxx-3f53-m92c
- https://nvd.nist.gov/vuln/detail/CVE-2022-43686