EUVD-2022-7379

🗓️ 03 Oct 2025 20:07:09Reported by EUVDType

Concrete CMS versions below 8.5.10 and between 9.0.0 and 9.1.2 do not issue new session IDs after OAuth.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2022-43687	16 Nov 202207:54	–	circl
CNNVD	PortlandLabs Concrete CMS 授权问题漏洞	14 Nov 202200:00	–	cnnvd
CVE	CVE-2022-43687	14 Nov 202200:00	–	cve
Cvelist	CVE-2022-43687	14 Nov 202200:00	–	cvelist
Github Security Blog	Concrete CMS vulnerable to Session Fixation	15 Nov 202212:00	–	github
NVD	CVE-2022-43687	14 Nov 202223:15	–	nvd
OSV	GHSA-M53V-5X5X-5M2P Concrete CMS vulnerable to Session Fixation	15 Nov 202212:00	–	osv
Prion	Authentication flaw	14 Nov 202223:15	–	prion
Positive Technologies	PT-2022-27003 · Unknown · Concrete Cms	14 Nov 202200:00	–	ptsecurity
RedhatCVE	CVE-2022-43687	23 May 202500:12	–	redhatcve

[
  {
    "enisaIdVendor": [
      {
        "id": "5275636b-c430-32ec-b1b0-931952a554a7",
        "vendor": {
          "name": "n/a"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "d3e93bc4-a005-3f34-b115-8abfd3e16aa2",
        "product": {
          "name": "n/a"
        },
        "product_version": "n/a"
      }
    ]
  }
]

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-43687
documentation	www.documentation.concretecms.org/developers/introduction/version-history/8510-release-notes
documentation	www.documentation.concretecms.org/developers/introduction/version-history/913-release-notes
github	www.github.com/concretecms/concretecms
github	www.github.com/concretecms/concretecms/releases/8.5.10
github	www.github.com/concretecms/concretecms/releases/9.1.3
concretecms	www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31

03 Oct 2025 20:07Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.15.4

EPSS0.0031

SSVC