Vulnerability Details CVE-2020-24986
Concrete5 up to and including 8.5.2 allows Unrestricted Upload of File with Dangerous Type such as a .php file via File Manager. It is possible to modify site configuration to upload the PHP file and execute arbitrary commands.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.01
EPSS Ranking 75.8%
CVSS Severity
CVSS v3 Score 7.2
CVSS v2 Score 9.0
Products affected by CVE-2020-24986
-
cpe:2.3:a:concretecms:concrete_cms:-
-
cpe:2.3:a:concretecms:concrete_cms:5.4.1.1
-
cpe:2.3:a:concretecms:concrete_cms:5.4.2
-
cpe:2.3:a:concretecms:concrete_cms:5.4.2.1
-
cpe:2.3:a:concretecms:concrete_cms:5.4.2.2
-
cpe:2.3:a:concretecms:concrete_cms:5.6.1
-
cpe:2.3:a:concretecms:concrete_cms:5.6.1.1
-
cpe:2.3:a:concretecms:concrete_cms:5.6.1.2
-
cpe:2.3:a:concretecms:concrete_cms:5.6.2
-
cpe:2.3:a:concretecms:concrete_cms:5.6.2.1
-
cpe:2.3:a:concretecms:concrete_cms:5.6.3
-
cpe:2.3:a:concretecms:concrete_cms:5.6.3.1
-
cpe:2.3:a:concretecms:concrete_cms:5.6.3.3
-
cpe:2.3:a:concretecms:concrete_cms:5.6.3.4
-
cpe:2.3:a:concretecms:concrete_cms:5.6.3.5
-
cpe:2.3:a:concretecms:concrete_cms:5.6.4.0
-
cpe:2.3:a:concretecms:concrete_cms:5.7.0
-
cpe:2.3:a:concretecms:concrete_cms:5.7.0.1
-
cpe:2.3:a:concretecms:concrete_cms:5.7.0.3
-
cpe:2.3:a:concretecms:concrete_cms:5.7.0.4
-
cpe:2.3:a:concretecms:concrete_cms:5.7.1
-
cpe:2.3:a:concretecms:concrete_cms:5.7.2
-
cpe:2.3:a:concretecms:concrete_cms:5.7.2.1
-
cpe:2.3:a:concretecms:concrete_cms:5.7.3
-
cpe:2.3:a:concretecms:concrete_cms:5.7.3.1
-
cpe:2.3:a:concretecms:concrete_cms:5.7.4
-
cpe:2.3:a:concretecms:concrete_cms:5.7.4.1
-
cpe:2.3:a:concretecms:concrete_cms:5.7.4.2
-
cpe:2.3:a:concretecms:concrete_cms:5.7.5
-
cpe:2.3:a:concretecms:concrete_cms:5.7.5.1
-
cpe:2.3:a:concretecms:concrete_cms:5.7.5.10
-
cpe:2.3:a:concretecms:concrete_cms:5.7.5.11
-
cpe:2.3:a:concretecms:concrete_cms:5.7.5.12
-
cpe:2.3:a:concretecms:concrete_cms:5.7.5.13
-
cpe:2.3:a:concretecms:concrete_cms:5.7.5.2
-
cpe:2.3:a:concretecms:concrete_cms:5.7.5.3
-
cpe:2.3:a:concretecms:concrete_cms:5.7.5.4
-
cpe:2.3:a:concretecms:concrete_cms:5.7.5.5
-
cpe:2.3:a:concretecms:concrete_cms:5.7.5.6
-
cpe:2.3:a:concretecms:concrete_cms:5.7.5.7
-
cpe:2.3:a:concretecms:concrete_cms:5.7.5.8
-
cpe:2.3:a:concretecms:concrete_cms:5.7.5.9
-
cpe:2.3:a:concretecms:concrete_cms:5.8.1.0
-
cpe:2.3:a:concretecms:concrete_cms:5.8.2.0
-
cpe:2.3:a:concretecms:concrete_cms:8.0
-
cpe:2.3:a:concretecms:concrete_cms:8.0.1
-
cpe:2.3:a:concretecms:concrete_cms:8.0.2
-
cpe:2.3:a:concretecms:concrete_cms:8.0.3
-
cpe:2.3:a:concretecms:concrete_cms:8.1.0
-
cpe:2.3:a:concretecms:concrete_cms:8.2.0
-
cpe:2.3:a:concretecms:concrete_cms:8.2.1
-
cpe:2.3:a:concretecms:concrete_cms:8.3.0
-
cpe:2.3:a:concretecms:concrete_cms:8.3.1
-
cpe:2.3:a:concretecms:concrete_cms:8.3.2
-
cpe:2.3:a:concretecms:concrete_cms:8.4.0
-
cpe:2.3:a:concretecms:concrete_cms:8.4.1
-
cpe:2.3:a:concretecms:concrete_cms:8.4.2
-
cpe:2.3:a:concretecms:concrete_cms:8.4.3
-
cpe:2.3:a:concretecms:concrete_cms:8.4.4
-
cpe:2.3:a:concretecms:concrete_cms:8.4.5
-
cpe:2.3:a:concretecms:concrete_cms:8.5.0
-
cpe:2.3:a:concretecms:concrete_cms:8.5.1
-
cpe:2.3:a:concretecms:concrete_cms:8.5.2