Password exposure in concrete5/core
Published 23 Nov 2021 · Updated 2 Dec 2024
Affected package
- Affected
- <8.5.7
- Fixed in
- 8.5.7
composer require concrete5/core:^8.5.7Details
Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5) prior to version 8.5.7. Concrete CMS now checks to see if a file has a password in view_inline and, if it does, the file is not rendered.For version 8.5.6, the following mitigations were put in place a. restricting file types for view_inline to images only b. putting a warning in the file manager to advise users.
Is GHSA-rhf5-f553-xg82 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected concrete5/core, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.