Security

There have been a number of medium and low security vulnerabilities that have been fixed in version 9 through 9.2. Thanks so much to all the community members who report vulnerabilities following the process outlined on https://www.concretecms.org/security so that they can be triaged and remediated!

Fortbridge, an independent external penetration testing firm, has just concluded the 2022 annual penetration testing and vulnerability assessment of Concrete CMS Hosting as well as the open source project. If you host sites or intranets on Concrete CMS Hosting, we would be happy to provide you with a copy of the report upon request. 

We recently announced that Concrete v8 will be end of life late 2022, but that doesn’t have to mean you won’t be able to run a Concrete v8 site beyond New Year's. 

[Update 14 Nov 2023 - Concrete v8 will have extended security maintenance through 2024]

Updated 2022-09-14: Critical Security updates for Concrete v8 will be issued through end 2023.  More info -  https://www.concretecms.org/about/project-news/security/security-support-concrete-v8x  

Original Blog: 

Please be aware that Concrete CMS version 8 will be EOL on 31 Dec 2022. We encourage you to plan to upgrade to Concrete version 9 before then. You are going to love the new features that come with version 9!

Concrete CMS has had a privacy policy for years which encompassed the Concrete related websites and the open source project. Now we have created a Concrete CMS Hosting Privacy Policy for those who host their websites and intranets with us. 

We are normally informed about supply chain hacks like this one from sources such as US-CERT (Homeland Security), DoD ARCYBER, SANS and the like. Official sources like these are important to follow to stay current, but yesterday we saw one happen more or less in real time.

Updated 2022-09-14: Critical Security updates for Concrete v8 will be issued through end 2023.  More info -  https://www.concretecms.org/about/project-news/security/security-support-concrete-v8x  

Original Blog: 

When we released Concrete CMS version 9 in 2021 we promised to continue to release security updates for the 8.5.x branch until at least May 1st, 2022. 

We are now extending that support period through December 31st, 2022.

MITRE has finally published CVE-2021-22954 that was remediated with Version 9.0. The CSRF token is stored in dynamic Javascript in Concrete CMS versions below 9
If you are running a Concrete Version below 9, we recommend you implement the mitigation - a header configuration applied to nginx or apache.

We patch and update stuff all the time behind the scenes for our Concrete CMS Hosting clients without blogging about it. However, there is a lot of publicity about PWNKIT CVE-2021-4034, a major Linux vulnerability so hot off the presses that the CVE is still in “reserved” status. This vulnerability allows basic users to gain root access. Hence, we are writing to let you know that we have implemented the suggested mitigation for all our servers and have tested to verify that the mitigation works.

We listened! Concrete CMS now has a Configuration Best Practices documentation page which provides a checklist to help you make sure that your Concrete site is secure!