Major Security Vulnerability Discovered in CMS System Used by US Army

guest · Aug 17, 2020

Major Security Vulnerability Discovered in CMS System Used by US Army
August 17, 2020
https://www.infosecurity-magazine.com/news/security-vulnerability-cms-us-army/

The content management system, Concrete5 CMS, contains a major vulnerability which has now been addressed in an updated version, according to an analysis published today by Edgescan.

Edgescan senior information security consultant, Guram Javakhishvili, revealed that Concrete5 has a Remote Code Evaluation (RCE), a known security weakness which if exploited, “can lead to a full compromise of the susceptible web application and also the web server that it is hosted on.”
Click to expand...

Concrete5 is a free CMS system that creates websites and is renowned for its ease of use. It is used by major organizations including GlobalSign, the US Army, REC and BASF.

By the ‘reverse shell’ mechanism, the attacker can then take full control over the web server. Through executing arbitrary commands on the server, the integrity, availability and confidentiality of it can be compromised. Additionally, moves can then be made to attack other servers on the internal network.
Javakhishvili added that the weakness has now been addressed by Concrete5 following the investigation, and the stable fixed release is out, version: 8.5.4.
Click to expand...

Edgescan: Vulnerabilities Discovered in Concrete5 by Edgescan Researcher

This blog post will address recent RCE vulnerability discovered by Edgescan Senior Information Security Consultant, Guram Javakhishvili. These vulnerabilities were discovered while validating alerts as part of Edgescan’s human intelligence verification.
Click to expand...

Log in or Sign up

Major Security Vulnerability Discovered in CMS System Used by US Army

guest Guest

Log in or Sign up

Major Security Vulnerability Discovered in CMS System Used by US Army

guest Guest

Useful Searches