CVE-2022-43687
First published: Mon Nov 14 2022(Updated: )
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authentication. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Concretecms Concrete Cms | <8.5.10 | |
| Concretecms Concrete Cms | >=9.0.0<=9.1.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes
- https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes
- https://github.com/concretecms/concretecms/releases/8.5.10
- https://github.com/concretecms/concretecms/releases/9.1.3
- https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31
Frequently Asked Questions
What is the severity of CVE-2022-43687?
The severity of CVE-2022-43687 is medium with a CVSS score of 5.4.
How does CVE-2022-43687 affect Concrete CMS?
CVE-2022-43687 affects Concrete CMS versions below 8.5.10 and between 9.0.0 and 9.1.2.
How can I fix CVE-2022-43687?
Remediate CVE-2022-43687 by updating Concrete CMS to version 9.1.3+ or 8.5.10+.
Where can I find more information about CVE-2022-43687?
You can find more information about CVE-2022-43687 in the release notes of Concrete CMS versions 8.5.10 and 9.1.3, as well as on the official GitHub page of Concrete CMS.
What is the Common Weakness Enumeration (CWE) ID associated with CVE-2022-43687?
The Common Weakness Enumeration (CWE) ID associated with CVE-2022-43687 is CWE-384.
- collector/nvd-index
- vendor/concretecms
- canonical/concretecms concrete cms
- version/concretecms concrete cms/9.0.0
- version/concretecms concrete cms/9.1.2