Password exposure in concrete5/core
The advisory, in context
Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5) prior to version 8.5.7. Concrete CMS now checks to see if a file has a password in view_inline and, if it does, the file is not rendered.For version 8.5.6, the following mitigations were put in place a. restricting file types for view_inline to images only b. putting a warning in the file manager to advise users.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 8.5.7
Fixed in 8.5.7
24 explicitly affected versions
8.2.0, 8.2.0RC2, 8.2.1, 8.3.0, 8.3.1, 8.3.2, 8.4.0, 8.4.0RC3, 8.4.0RC4, 8.4.1, 8.4.2, 8.4.3, 8.4.4, 8.4.5, 8.5.0, 8.5.0RC1, 8.5.0RC2, 8.5.1, 8.5.2, 8.5.3, 8.5.4, 8.5.5, 8.5.6, 8.5.6RC1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.5.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"8.2.0",
"8.2.0RC2",
"8.2.1",
"8.3.0",
"8.3.1",
"8.3.2",
"8.4.0",
"8.4.0RC3",
"8.4.0RC4",
"8.4.1",
"8.4.2",
"8.4.3",
"8.4.4",
"8.4.5",
"8.5.0",
"8.5.0RC1",
"8.5.0RC2",
"8.5.1",
"8.5.2",
"8.5.3",
"8.5.4",
"8.5.5",
"8.5.6",
"8.5.6RC1"
]
}