CVE-2023-48648: Critical severity ConcreteCMS Concrete Cms vulnerability
Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions (such as the Mkdir() function) gives universal access (0777) to created folders by default. Excessive permissions can be granted when creating a directory with permissions greater than 0755 or when the permissions argument is not specified.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-48648.
What versions of Concrete CMS are affected by this vulnerability?
Concrete CMS versions before 8.5.13 and 9.x before 9.2.2 are affected by this vulnerability.
How can unauthorized access be achieved in Concrete CMS?
Unauthorized access can be achieved in Concrete CMS due to directories being created with insecure permissions.
What is the default access permission for created folders in Concrete CMS?
The default access permission for created folders in Concrete CMS is 0777.
How can the vulnerability be fixed in Concrete CMS?
To fix the vulnerability, update Concrete CMS to version 8.5.13 or 9.2.2, depending on the installed version.