Home > Vulnerability Database > CVE-2020-11476

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2020-11476

Date: July 28, 2020

Concrete5 before 8.5.3 allows Unrestricted Upload of File with Dangerous Type such as a .phar file.

Language: PHP

Severity Score

7.2

Related Resources (9)

Url: https://github.com/concrete5/concrete5

Url: https://github.com/concrete5/concrete5/pull/8713

Url: https://github.com/concretecms/concretecms/commit/d296f4ba4f6ad94b199c21c1b16f0d185adab343

Url: https://herolab.usd.de/security-advisories/

Url: https://herolab.usd.de/security-advisories/usd-2020-0041/

Url: https://github.com/concrete5/concrete5/releases/tag/8.5.3

Url: https://herolab.usd.de/security-advisories/usd-2020-0041

Url: https://nvd.nist.gov/vuln/detail/CVE-2020-11476

Url: https://www.mend.io/vulnerability-database/CVE-2020-11476

Severity Score

7.2

Weakness Type (CWE)

Unrestricted Upload of File with Dangerous Type

CWE-434

CVSS v3.1

Base Score:	7.2
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	HIGH
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

CVSS v2

Base Score:	9.0
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	SINGLE
Confidentiality (C):	COMPLETE
Integrity (I):	COMPLETE
Availability (A):	COMPLETE
Additional information:

Do you need more information?

Contact Us