PT-2023-30868 · Unknown · Concrete Cms
Tahabiyikli-Vortex
·
Publicado
2023-11-17
·
Atualizado
2024-08-29
·
CVE-2023-48648
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Concrete CMS versions prior to 8.5.13
Concrete CMS versions 9.x prior to 9.2.2
Description
The issue allows unauthorized access due to directories being created with insecure permissions. File creation functions, such as the
Mkdir() function, give universal access (0777) to created folders by default. Excessive permissions can be granted when creating a directory with permissions greater than 0755 or when the permissions argument is not specified.Recommendations
For versions prior to 8.5.13, update to version 8.5.13 or later to resolve the issue.
For versions 9.x prior to 9.2.2, update to version 9.2.2 or later to resolve the issue.
As a temporary workaround, consider setting the permissions argument to 0755 or less when creating directories using the
Mkdir() function to minimize the risk of exploitation.Correção
Incorrect Default Permissions
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Concrete Cms