PT-2020-12634 · Concrete5 · Concrete5

Gerbert Roitburd · Published 2020-07-28 · Updated 2021-11-03 · CVE-2020-11476

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Concrete5 versions prior to 8.5.3

Description The issue allows for the unrestricted upload of files with dangerous types, such as .phar files.

Recommendations For versions prior to 8.5.3, update to version 8.5.3 or later to resolve the issue.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-11476

GHSA-HF9P-9R39-R2H3

Affected Products

Concrete5

References · 10

• 🔥 https://herolab.usd.de/security-advisories/usd-2020-0041 · Exploit
• https://github.com/concrete5/concrete5/pull/8713 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-11476 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11476 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hf9p-9r39-r2h3 · Vendor Advisory
• https://github.com/concrete5/concrete5/releases/tag/8.5.3 · Note
• https://github.com/concrete5/concrete5 · Note
• https://github.com/concretecms/concretecms/commit/d296f4ba4f6ad94b199c21c1b16f0d185adab343 · Note
• https://herolab.usd.de/security-advisories · Note
• https://t.me/cvenotify/22803 · Telegram Post