CVE-2021-40102: Critical severity ConcreteCMS Concrete CMS vulnerability
Published Sep 24, 2021
·Updated
An issue was discovered in Concrete CMS through 8.5.5. Arbitrary File deletion can occur via PHAR deserialization in isdir (PHP Object Injection associated with the wakeup magic method).
Affected Software
1 affected component
ConcreteCMS Concrete CMS<=8.5.5
Event History
Sep 24, 2021
CVE Published
via MITRE·02:55 PM
Data Sourced
via MITRE·02:55 PM
Description
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2021-40102?
CVE-2021-40102 has a high severity rating due to the potential for arbitrary file deletion.
2
How do I fix CVE-2021-40102?
To fix CVE-2021-40102, update Concrete CMS to the latest version beyond 8.5.5.
3
What kind of attack vector is associated with CVE-2021-40102?
CVE-2021-40102 is associated with PHP Object Injection via PHAR deserialization.
4
Can CVE-2021-40102 affect my website?
Yes, if you are using Concrete CMS version 8.5.5 or earlier, your website could be vulnerable to CVE-2021-40102.
5
What is the impact of CVE-2021-40102 on affected systems?
The impact of CVE-2021-40102 allows an attacker to delete arbitrary files, compromising system integrity.