critical9.8
CVE-2023-28473
Concrete CMS (previously concrete5) is vulnerable to possible auth bypass in the jobs section
Impact
Concrete CMS (previously concrete5) before 9.2 is vulnerable to possible Auth bypass in the jobs section.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | concrete5/concrete5 | < 9.2.0 | 9.2.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Concretecms | Concrete Cms | before 9.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://concretecms.com
- https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release
- https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20
- https://github.com/advisories/GHSA-pj76-75cm-3552
- https://nvd.nist.gov/vuln/detail/CVE-2023-28473
- https://github.com/concretecms/concretecms/pull/11749
- https://github.com/concretecms/concretecms/releases/tag/8.5.13