CVE-2022-30117: Path Traversal
Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete doesn’t allow traversal and by changing isFullChunkFilePresent to have an early false return when input doesn't match expectations.Concrete CMS Security team ranked this 5.8 with CVSS v3.1 vector AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H. Credit to Siebene for reporting.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-30117?
The severity of CVE-2022-30117 is critical with a severity value of 9.1.
How does CVE-2022-30117 allow traversal?
CVE-2022-30117 allows traversal in /index.php/ccm/system/file/upload.
What is the potential exploit of CVE-2022-30117?
The potential exploit of CVE-2022-30117 is Arbitrary File Delete.
How was CVE-2022-30117 remediated?
CVE-2022-30117 was remediated by sanitizing /index.php/ccm/system/file/upload and changing certain functionalities.
Where can I find more information about CVE-2022-30117?
More information about CVE-2022-30117 can be found at the provided references.