1. Home
  2. CVE Database
  3. CVE-2020-24986
HIGH · 7.2

CVE-2020-24986

Concrete5 up to and including 8.5.2 allows Unrestricted Upload of File with Dangerous Type such as a .php file via File Manager. It is possible to modify site configuration to upload the PHP file and ...

Vulnerability Description

Concrete5 up to and including 8.5.2 allows Unrestricted Upload of File with Dangerous Type such as a .php file via File Manager. It is possible to modify site configuration to upload the PHP file and execute arbitrary commands.

CVSS Score

7.2

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
ConcretecmsConcrete Cms<= 8.5.2

Related Weaknesses (CWE)

CWE-434

References

FAQ

What is CVE-2020-24986?

CVE-2020-24986 is a vulnerability with a CVSS score of 7.2 (HIGH). Concrete5 up to and including 8.5.2 allows Unrestricted Upload of File with Dangerous Type such as a .php file via File Manager. It is possible to modify site configuration to upload the PHP file and ...

How severe is CVE-2020-24986?

CVE-2020-24986 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-24986?

Check the references section above for vendor advisories and patch information. Affected products include: Concretecms Concrete Cms.