Information Disclosure

concrete5/core is vulnerable to information disclosure. Password protected files are exposed to any users using viewinline because it does not limit file types for viewinline to images only...

CVE-2021-22951

CVE-2021-22951 affects Concrete CMS (formerly concrete5) prior to 8.5.7. Unauthorized individuals could view password-protected files via the view_inline functionality, exposing protected content. The root cause was that view_inline could render a file even if it had a password. Mitigations imple...