exploitDog

CVE-2020-11476

Опубликовано: 28 июл. 2020

Источник: nvd

CVSS3: 7.2

CVSS2: 9

EPSS Низкий

Описание

Concrete5 before 8.5.3 allows Unrestricted Upload of File with Dangerous Type such as a .phar file.

Ссылки

https://github.com/concrete5/concrete5/pull/8713
Patch
Third Party Advisory
https://github.com/concrete5/concrete5/releases/tag/8.5.3
Release Notes
Third Party Advisory
https://herolab.usd.de/security-advisories/
Third Party Advisory
https://herolab.usd.de/security-advisories/usd-2020-0041/
Exploit
Third Party Advisory
https://github.com/concrete5/concrete5/pull/8713
Patch
Third Party Advisory
https://github.com/concrete5/concrete5/releases/tag/8.5.3
Release Notes
Third Party Advisory
https://herolab.usd.de/security-advisories/
Third Party Advisory
https://herolab.usd.de/security-advisories/usd-2020-0041/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*

Версия до 8.5.3 (исключая)

EPSS

Процентиль: 77%

0.0102

Низкий

7.2 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-434

Связанные уязвимости

GHSA-hf9p-9r39-r2h3

CVSS3: 7.2

github

больше 4 лет назад

Unrestricted Uploads in Concrete5

EPSS

Процентиль: 77%

0.0102

Низкий

7.2 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-434