CVE-2021-40099: High severity ConcreteCMS Concrete CMS vulnerability
An issue was discovered in Concrete CMS through 8.5.5. Fetching the update json scheme over HTTP leads to remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMSto a version that resolves this vulnerability.Fixed in 8.5.5 - Compensating control
Prevent use of HTTP for fetching the update JSON scheme (block/disable HTTP and require HTTPS) to mitigate remote code execution.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-40099?
CVE-2021-40099 has a high severity rating due to its potential for remote code execution.
How do I fix CVE-2021-40099?
To fix CVE-2021-40099, update Concrete CMS to version 8.5.6 or later.
What systems are affected by CVE-2021-40099?
CVE-2021-40099 affects Concrete CMS versions up to and including 8.5.5.
What type of vulnerability is CVE-2021-40099?
CVE-2021-40099 is categorized as a remote code execution vulnerability.
How can I check if my Concrete CMS is affected by CVE-2021-40099?
You can check your Concrete CMS version in the admin dashboard to see if it is at or below 8.5.5.