CVE-2021-36766: High severity ConcreteCMS Concrete CMS vulnerability
Concrete5 through 8.5.5 deserializes Untrusted Data. The vulnerable code is located within the controllers/singlepage/dashboard/system/environment/logging.php Logging::updatelogging() method. User input passed through the logFile request parameter is not properly sanitized before being used in a call to the fileexists() PHP function. This can be exploited by malicious users to inject arbitrary PHP objects into the application scope (PHP Object Injection via phar:// stream wrapper), allowing them to carry out a variety of attacks, such as executing arbitrary PHP code.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-36766?
CVE-2021-36766 has a medium severity level due to its potential for deserializing untrusted data.
How do I fix CVE-2021-36766?
To fix CVE-2021-36766, update your Concrete5 installation to version 8.5.6 or later.
Which versions of Concrete5 are affected by CVE-2021-36766?
CVE-2021-36766 affects Concrete5 versions up to 8.5.5.
What kind of attack does CVE-2021-36766 enable?
CVE-2021-36766 enables remote code execution through unsafe deserialization of user inputs.
Is there a patch available for CVE-2021-36766?
Yes, a patch is included in Concrete5 version 8.5.6 which resolves the vulnerability.