CVE-2023-48648
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 1.2%
exploitation probability
1.2%top 32% of all CVEs
observed exploitation
nono source reports it
Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions (such as the Mkdir() function) gives universal access (0777) to created folders by default. Excessive permissions can be granted when creating a directory with permissions greater than 0755 or when the permissions argument is not specified.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/aReferences
https://documentation.concretecms.org/developers/introduction/version-history/8513-release-noteshttps://documentation.concretecms.org/developers/introduction/version-history/922-release-noteshttps://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release