CVE-2021-22951

Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5) prior to version 8.5.7. Concrete CMS now checks to see if a file has a password in view_inline and, if it does, the file is not rendered.For version 8.5.6, the following mitigations were put in place a. restricting file types for view_inline to images only b. putting a warning in the file manager to advise users.Credit for discovery: "Solar Security Research Team"Concrete CMS security team CVSS scoring is 5.3: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NThis fix is also in Concrete version 9.0.0

• CWE-639
• CWE-639

• https://documentation.concretecms.org/developers/introduction/version-history/857-release-notesRelease Notes, Vendor Advisory
• https://hackerone.com/reports/1102014Permissions Required, Third Party Advisory
• https://documentation.concretecms.org/developers/introduction/version-history/857-release-notesRelease Notes, Vendor Advisory
• https://hackerone.com/reports/1102014Permissions Required, Third Party Advisory

Published

Nov 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-22946A user can tell curl >= 7.20.0 and <= 7.78.0 to require a su…7.5
• CVE-2021-22947When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP…5.9
• CVE-2021-22948Vulnerability in the generation of session IDs in revive-ads…7.1
• CVE-2021-22949A CSRF in Concrete CMS version 8.5.5 and below allows an att…5.4
• CVE-2021-2295Vulnerability in the Oracle Concurrent Processing product of…8.1
• CVE-2021-22950Concrete CMS prior to 8.5.6 had a CSFR vulnerability allowin…6.5
• CVE-2021-22952A vulnerability found in UniFi Talk application V1.12.3 and …8.8
• CVE-2021-22953A CSRF in Concrete CMS version 8.5.5 and below allows an att…5.4
• CVE-2021-22954A cross-site request forgery vulnerability exists in Concret…8.8
• CVE-2021-22955A unauthenticated denial of service vulnerability exists in …7.5
• CVE-2021-22956An uncontrolled resource consumption vulnerability exists in…7.5
• CVE-2021-22957A Cross-Origin Resource Sharing (CORS) vulnerability found i…8.8