PT-2020-15877 · Concrete5 · Concrete5

Published 2020-09-04 · Updated 2021-11-01 · CVE-2020-24986

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Concrete5 versions up to and including 8.5.2

Description The issue allows for the unrestricted upload of files with dangerous types, such as .php files, via the File Manager. This can be achieved by modifying the site configuration to upload the PHP file, which can then be used to execute arbitrary commands.

Recommendations For Concrete5 versions up to and including 8.5.2, update to a version that restricts the upload of dangerous file types or modify the site configuration to prevent such uploads. As a temporary workaround, consider restricting access to the File Manager to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-24986

Affected Products

Concrete5

References · 4

• 🔥 https://hackerone.com/reports/768322 · Exploit
• https://osv.dev/vulnerability/CVE-2020-24986 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24986 · Security Note
• https://t.me/cvenotify/22802 · Telegram Post