What is CVE-2023-48648?

CVE-2023-48648 is a critical-severity vulnerability in Concretecms Concrete_cms, classified under Incorrect Default Permissions. CVSS score: 9.8/10. Published 2023-11-17.

How severe is CVE-2023-48648?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Concretecms Concrete_cms

CVE-2023-48648

Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions (such as the Mkdir() function) gives universal access (0777) to created folder…

EPSS: 0.012 (65.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Concretecms Concrete_cms
N/a — versions n/a

Weakness classification (CWE)

CWE-276 — Incorrect Default Permissions

References

cve@mitre.org (Release Notes, Vendor Advisory)
cve@mitre.org (Release Notes)
cve@mitre.org (Release Notes)

Frequently asked questions

What is CVE-2023-48648?: CVE-2023-48648 is a critical-severity vulnerability in Concretecms Concrete_cms, classified under Incorrect Default Permissions. CVSS score: 9.8/10. Published 2023-11-17.
How severe is CVE-2023-48648?: Critical severity. CVSS v3 base score is 9.8 out of 10.