CVE-2020-24986

Concrete5 up to and including 8.5.2 allows Unrestricted Upload of File with Dangerous Type such as a .php file via File Manager

published September 4, 2020

CVSS
—
EPSS
2%
Percentile
80.4
In the wild
Unconfirmed
What it is

Concrete5 up to and including 8.5.2 allows Unrestricted Upload of File with Dangerous Type such as a .php file via File Manager. It is possible to modify site configuration to upload the PHP file and execute arbitrary commands.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01981 · 80.4th percentile
Published
2020-09-04T19:29Z
EPSS history
Timeline
  • 04 SEP 19:29Z
    Concrete5 up to and including 8.5.2 allows Unrestricted Upload of File with Dangerous Type such as a .php file via File Manager
    cvelistv5