CVE-2023-48648
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions (such as the Mkdir() function) gives universal access (0777) to created folders by default. Excessive permissions can be granted when creating a directory with permissions greater than 0755 or when the permissions argument is not specified.
| Vendor | n/a |
| Product | n/a |
| Published | Nov 17, 2023 |
| Last Updated | Aug 29, 2024 |
Stay Ahead of the Next One
Get instant alerts for n/a n/a
Be the first to know when new critical vulnerabilities affecting n/a n/a are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
n/a / n/a
n/a
References
concretecms.org: https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release documentation.concretecms.org: https://documentation.concretecms.org/developers/introduction/version-history/922-release-notes documentation.concretecms.org: https://documentation.concretecms.org/developers/introduction/version-history/8513-release-notes