DATABASE RESOURCES PRICING ABOUT US

{"id": "OSV:GHSA-3CXX-3F53-M92C", "vendorId": null, "type": "osv", "bulletinFamily": "software", "title": "Concrete CMS vulnerable to Uncontrolled Resource Consumption leading to DoS", "description": "In Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2, the authTypeConcreteCookieMap table can be filled up causing a denial of service (high load).", "published": "2022-11-15T12:00:17", "modified": "2023-04-11T01:32:50", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {"cvssV3": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM"}, "exploitabilityScore": 2.8, "impactScore": 3.6}, "href": "https://osv.dev/vulnerability/GHSA-3cxx-3f53-m92c", "reporter": "Google", "references": ["https://nvd.nist.gov/vuln/detail/CVE-2022-43686", "https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes", "https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes", "https://github.com/concretecms/concretecms", "https://github.com/concretecms/concretecms/releases/8.5.10", "https://github.com/concretecms/concretecms/releases/9.1.3", "https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31"], "cvelist": ["CVE-2022-43686"], "immutableFields": [], "lastseen": "2023-04-11T01:33:35", "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2022-43686"]}, {"type": "github", "idList": ["GHSA-3CXX-3F53-M92C"]}, {"type": "veracode", "idList": ["VERACODE:38015"]}]}, "score": {"value": 1.2, "vector": "NONE"}, "affected_software": {"major_version": [{"name": "concrete5/concrete5", "version": 9}, {"name": "concrete5/concrete5", "version": 9}, {"name": "concrete5/concrete5", "version": 9}, {"name": "concrete5/concrete5", "version": 9}, {"name": "concrete5/concrete5", "version": 9}, {"name": "concrete5/concrete5", "version": 9}]}, "epss": [{"cve": "CVE-2022-43686", "epss": 0.00056, "percentile": 0.21423, "modified": "2023-04-10"}], "vulnersScore": 1.2}, "_state": {"dependencies": 1681176908, "score": 1684017570, "affected_software_major_version": 0, "epss": 1681176758}, "_internal": {"score_hash": "1e9662fb2a7de6a7a7220c1a2ccda622"}, "affectedSoftware": [{"version": "9.0.0", "operator": "eq", "name": "concrete5/concrete5"}, {"version": "9.0.1", "operator": "eq", "name": "concrete5/concrete5"}, {"version": "9.0.2", "operator": "eq", "name": "concrete5/concrete5"}, {"version": "9.1.0", "operator": "eq", "name": "concrete5/concrete5"}, {"version": "9.1.1", "operator": "eq", "name": "concrete5/concrete5"}, {"version": "9.1.2", "operator": "eq", "name": "concrete5/concrete5"}]}

{"cve": [{"lastseen": "2023-06-03T15:08:31", "description": "In Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2, the authTypeConcreteCookieMap table can be filled up causing a denial of service (high load).", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2022-11-14T22:15:00", "type": "cve", "title": "CVE-2022-43686", "cwe": ["CWE-400"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-43686"], "modified": "2022-11-17T22:00:00", "cpe": ["cpe:/a:concretecms:concrete_cms:9.1.2"], "id": "CVE-2022-43686", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-43686", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:a:concretecms:concrete_cms:9.1.2:*:*:*:*:*:*:*"]}], "github": [{"lastseen": "2023-06-03T17:12:39", "description": "In Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2, the authTypeConcreteCookieMap table can be filled up causing a denial of service (high load).", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2022-11-15T12:00:17", "type": "github", "title": "Concrete CMS vulnerable to Uncontrolled Resource Consumption leading to DoS", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-43686"], "modified": "2023-02-01T05:03:57", "id": "GHSA-3CXX-3F53-M92C", "href": "https://github.com/advisories/GHSA-3cxx-3f53-m92c", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}], "veracode": [{"lastseen": "2023-06-03T20:06:50", "description": "Concrete CMS is vulnerable to denial of service.The vulnerability exists in multiple functions of `controller.php` due to insufficient validation of user-supplied input within the `forever` cookie which allows an attacker to crash the application via malicious input.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2022-11-16T04:33:14", "type": "veracode", "title": "Denial Of Service (DoS)", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2022-43686"], "modified": "2022-11-18T00:03:21", "id": "VERACODE:38015", "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-38015/summary", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}]}