CVE-2021-36766 Deserialization in n/a
Malicious users can inject arbitrary PHP objects via the logFile parameter in Concrete5, potentially leading to arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-36766?
CVE-2021-36766 is a high-severity unsafe deserialization vulnerability in Concretecms Concrete Cms, published on 27 Jul 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Concrete5 through 8.5.5 deserializes Untrusted Data. The vulnerable code is located within the controllers/single_page/dashboard/system/environment/logging.php Logging::update_logging() method. User input passed through the logFile request parameter is not properly sanitized before being used in a call to the file_exists() PHP function. This can be exploited by malicious users to inject arbitrary PHP objects into the application scope (PHP Object Injection via phar:// stream wrapper), allowing them to carry out a variety of attacks, such as executing arbitrary PHP code.
Weakness: CWE-502
Which versions are affected by CVE-2021-36766?
It affects 1 product.
Products include Concretecms Concrete Cms.
How do I fix CVE-2021-36766?
No fix has been published for CVE-2021-36766 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2021-36766 being exploited?
There is no known exploitation of CVE-2021-36766 in the wild and no public exploit code.
Other vulnerabilities in Concretecms Concrete Cms
- CVE-2023-48648 Concrete CMS allows unauthorized access because directories can be created with insecure permissions
- CVE-2022-21829 Code injection in concrete CMS
- CVE-2021-22958 Server-Side Request Forgery vulnerability in concrete5
- CVE-2021-40098 Path traversal in n/a
- CVE-2026-8134 Concrete CMS Vulnerable to Relative Path Traversal
Sources
Also known as GHSA-492p-w2m4-4h4m.