Security restricitons bypass in concrete5 - CVE-2020-24986
Published: September 7, 2020
Vulnerability identifier: #VU46308
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2020-24986
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: PortlandLabs
Affected software:
concrete5
concrete5
Detailed vulnerability description
The vulnerability allows a remote user to execute arbitrary PHP code.
The vulnerability exists due to application allows Concrete5 administrators to allow uploading of .php files to the server via File Manager. Once PHP files are allowed, a remote unprivileged user can upload and execute arbitrary PHP file on the system.
How to mitigate CVE-2020-24986
Install updates from vendor's website.