CVE-2023-48648
Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.23%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions (such as the Mkdir() function) gives universal access (0777) to created folders by default. Excessive permissions can be granted when creating a directory with permissions greater than 0755 or when the permissions argument is not specified.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.23% probability · 67th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-276
- Affected
- concretecms/concrete cms
- Source
- cve@mitre.org
References
- https://documentation.concretecms.org/developers/introduction/version-history/8513-release-notesRelease Notes
- https://documentation.concretecms.org/developers/introduction/version-history/922-release-notesRelease Notes
- https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-releaseRelease Notes, Vendor Advisory
- https://documentation.concretecms.org/developers/introduction/version-history/8513-release-notesRelease Notes
- https://documentation.concretecms.org/developers/introduction/version-history/922-release-notesRelease Notes
- https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-releaseRelease Notes, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.