CVE-2020-11476
HIGHConcretecms Concrete Cms < 8.5.3 - Unrestricted File Upload
Title source: ruleDescription
Concrete5 before 8.5.3 allows Unrestricted Upload of File with Dangerous Type such as a .phar file.
References (4)
Core 4
Core References
Third Party Advisory x_refsource_misc
https://herolab.usd.de/security-advisories/
Exploit, Third Party Advisory x_refsource_misc
https://herolab.usd.de/security-advisories/usd-2020-0041/
Patch, Third Party Advisory x_refsource_confirm
https://github.com/concrete5/concrete5/pull/8713
Release Notes, Third Party Advisory x_refsource_confirm
https://github.com/concrete5/concrete5/releases/tag/8.5.3
Scores
CVSS v3
7.2
EPSS
0.0075
EPSS Percentile
73.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-434
Status
published
Products (2)
concrete5/concrete5
0 - 8.5.3Packagist
concretecms/concrete_cms
< 8.5.3
Published
Jul 28, 2020
Tracked Since
Feb 18, 2026