Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Concrete CMS: Auth Cookie Table Overflow

CVE-2022-43686 · published 3 years ago
Summary

Concrete CMS versions 8.5.10 and below, and 9.0.0 to 9.1.2, are at risk of a denial of service attack. This can happen if an attacker fills up the authTypeConcreteCookieMap table, causing high server load. To protect your site, update to Concrete CMS version 9.1.3 or higher.

What to do
  • Update concrete5 concrete5 to version 8.5.10.
  • Update concrete5 concrete5 to version 9.1.3.
Affected software
Ecosystem VendorProductAffected versions
composer concrete5 concrete5 < 8.5.10
>= 9.0.0, < 9.1.3
Fix: upgrade to 8.5.10
– concretecms concrete_cms < 8.5.10
>= 9.0.0, <= 9.1.2
cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*
Original advisory text
In Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2, the authTypeConcreteCookieMap table can be filled up causing a denial of service (high load).
In Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2, the authTypeConcreteCookieMap table can be filled up causing a denial of service (high load).
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published14 Nov 2022
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-3cxx-3f53-m92c · GHSA
CVE-2022-43686 · NVD
CVE-2022-43686 · OSV
Track software like this
Free during beta