<p>Upgrade <code>concrete5/concrete5</code> to version 8.5.3 or higher.</p>

Remote Code Execution (RCE) Affecting concrete5/concrete5 package, versions <8.5.3

Snyk CVSS

Attack Complexity High

Privileges Required High

Scope Changed

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS 0.11% (45^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-PHP-CONCRETE5CONCRETE5-609854
published 6 Sep 2020
disclosed 6 Sep 2020
credit Unknown

Report a new vulnerability Found a mistake?

Introduced: 6 Sep 2020

CVE-2020-24986 Open this link in a new tab CWE-94 Open this link in a new tab

How to fix?

Upgrade concrete5/concrete5 to version 8.5.3 or higher.

Overview

concrete5/concrete5 is a concrete5 open source CMS.

Affected versions of this package are vulnerable to Remote Code Execution (RCE). It allows Unrestricted Upload of File with Dangerous Type such as a .php file via File Manager. It is possible to modify site configuration to upload the PHP file and execute arbitrary commands.