Log in Start free

Vulnerability · Published Nov 17, 2023 · Assigned by mitre

CVE-2023-48648

Critical 9.8

In plain English

A critical-severity incorrect default permissions in the concrete5/concrete5 package (Packagist). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.2%top 30.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions (such as the Mkdir() function) gives universal access (0777) to created folders by default. Excessive permissions can be granted when creating a directory with permissions greater than 0755 or when the permissions argument is not specified.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistconcrete5/concrete58.5.13GHSA-m87h-jxr6-f82w
Packagistconcrete5/concrete59.2.2GHSA-m87h-jxr6-f82w

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-276 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References