- Vulnerability/
- GHSA-m87h-jxr6-f82w
GHSA-m87h-jxr6-f82w
First published: Fri Nov 17 2023(Updated: )
Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions (such as the Mkdir() function) gives universal access (0777) to created folders by default. Excessive permissions can be granted when creating a directory with permissions greater than 0755 or when the permissions argument is not specified.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/concrete5/concrete5 | >=9.0.0<9.2.2 | 9.2.2 |
| composer/concrete5/concrete5 | <8.5.13 | 8.5.13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2023-48648
- https://documentation.concretecms.org/developers/introduction/version-history/8513-release-notes
- https://documentation.concretecms.org/developers/introduction/version-history/922-release-notes
- https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release
- https://github.com/concretecms/concretecms/pull/11677
- https://github.com/concretecms/concretecms/commit/707b974826b761dda5c0baaf345c8582157d9307
- https://github.com/concretecms/concretecms/commit/eb882681a0ed19798a8f689d257af8dfe2f3a279
- https://github.com/advisories/GHSA-m87h-jxr6-f82w (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is GHSA-m87h-jxr6-f82w.
What is the title of this vulnerability?
The title of this vulnerability is 'Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions.'
What software versions are affected by this vulnerability?
Concrete CMS versions before 8.5.13 and 9.x before 9.2.2 are affected by this vulnerability.
How can unauthorized access be gained due to this vulnerability?
Unauthorized access can be gained due to this vulnerability by creating directories with insecure permissions, granting excessive access.
What is the recommended remedy for this vulnerability?
The recommended remedy for this vulnerability is to update Concrete CMS to version 8.5.13 or 9.2.2, depending on the currently installed version.
- collector/github-advisory-latest
- alias/GHSA-m87h-jxr6-f82w
- alias/CVE-2023-48648
- collector/github-advisory
- package-manager/composer