How severe is CVE-2023-28821?

CVE-2023-28821 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2023-28821 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (53rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-28821?

CVE-2023-28821 affects Concretecms Concrete Cms. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2023-28821?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2023-28821 published?

CVE-2023-28821 was published on 2023-04-28 and last updated on 2026-06-17.

CVE-2023-28821

CVE-2023-28821 is a medium-severity vulnerability in Concretecms Concrete Cms with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-640.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 1% (53rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-640
Affected product: Concretecms Concrete Cms
Published: 2023-04-28
Last modified: 2026-06-17

Description

Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.

Frequently asked questions

What is CVE-2023-28821?: Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.
How severe is CVE-2023-28821?: CVE-2023-28821 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2023-28821 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (53rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-28821?: CVE-2023-28821 affects Concretecms Concrete Cms. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2023-28821?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2023-28821 published?: CVE-2023-28821 was published on 2023-04-28 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*

More vulnerabilities in Concretecms Concrete Cms

CVE-2023-48648 — Critical (CVSS 9.8): Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with…
CVE-2022-21829 — Critical (CVSS 9.8): Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from…
CVE-2021-22958 — Critical (CVSS 9.8): A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP…
CVE-2021-40098 — Critical (CVSS 9.8): An issue was discovered in Concrete CMS through 8.5.5. Path Traversal leading to RCE via external form by adding a…
CVE-2026-85385 — Critical (CVSS 9.6): Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on write and rendered it without output…
CVE-2022-30117 — Critical (CVSS 9.1): Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload…

All CVEs affecting Concretecms Concrete Cms →

Other CWE-640 vulnerabilities

CVE-2025-63314 — Critical (CVSS 10.0): A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to…
CVE-2023-7028 — Critical (CVSS 10.0): An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9,…
CVE-2026-102115 — Critical (CVSS 9.8): Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated…
CVE-2026-19632 — Critical (CVSS 9.8): The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive…
CVE-2026-77264 — Critical (CVSS 9.8): The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is…
CVE-2026-15689 — Critical (CVSS 9.8): Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request…

Browse all CWE-640 vulnerabilities →