From 308c15ea1fb50e898ca018e7917259e5204696a0 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 17 Nov 2023 22:45:26 +0000
Subject: [PATCH] Publish Advisories

GHSA-m87h-jxr6-f82w
GHSA-m87h-jxr6-f82w
---
 .../GHSA-m87h-jxr6-f82w.json                  | 97 +++++++++++++++++++
 .../GHSA-m87h-jxr6-f82w.json                  | 43 --------
 2 files changed, 97 insertions(+), 43 deletions(-)
 create mode 100644 advisories/github-reviewed/2023/11/GHSA-m87h-jxr6-f82w/GHSA-m87h-jxr6-f82w.json
 delete mode 100644 advisories/unreviewed/2023/11/GHSA-m87h-jxr6-f82w/GHSA-m87h-jxr6-f82w.json

diff --git a/advisories/github-reviewed/2023/11/GHSA-m87h-jxr6-f82w/GHSA-m87h-jxr6-f82w.json b/advisories/github-reviewed/2023/11/GHSA-m87h-jxr6-f82w/GHSA-m87h-jxr6-f82w.json
new file mode 100644
index 00000000000..6526fd26a0b
--- /dev/null
+++ b/advisories/github-reviewed/2023/11/GHSA-m87h-jxr6-f82w/GHSA-m87h-jxr6-f82w.json
@@ -0,0 +1,97 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-m87h-jxr6-f82w",
+  "modified": "2023-11-17T22:44:04Z",
+  "published": "2023-11-17T06:31:21Z",
+  "aliases": [
+    "CVE-2023-48648"
+  ],
+  "summary": "Concrete CMS allows unauthorized access because directories can be created with insecure permissions",
+  "details": "Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions (such as the Mkdir() function) gives universal access (0777) to created folders by default. Excessive permissions can be granted when creating a directory with permissions greater than 0755 or when the permissions argument is not specified.",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "concrete5/concrete5"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "8.5.13"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "concrete5/concrete5"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "9.0.0"
+            },
+            {
+              "fixed": "9.2.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48648"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/concretecms/concretecms/pull/11677"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/concretecms/concretecms/commit/707b974826b761dda5c0baaf345c8582157d9307"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/concretecms/concretecms/commit/eb882681a0ed19798a8f689d257af8dfe2f3a279"
+    },
+    {
+      "type": "WEB",
+      "url": "https://documentation.concretecms.org/developers/introduction/version-history/8513-release-notes"
+    },
+    {
+      "type": "WEB",
+      "url": "https://documentation.concretecms.org/developers/introduction/version-history/922-release-notes"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/concretecms/concretecms"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2023-11-17T22:44:04Z",
+    "nvd_published_at": "2023-11-17T04:15:07Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2023/11/GHSA-m87h-jxr6-f82w/GHSA-m87h-jxr6-f82w.json b/advisories/unreviewed/2023/11/GHSA-m87h-jxr6-f82w/GHSA-m87h-jxr6-f82w.json
deleted file mode 100644
index 122a7ff797b..00000000000
--- a/advisories/unreviewed/2023/11/GHSA-m87h-jxr6-f82w/GHSA-m87h-jxr6-f82w.json
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-m87h-jxr6-f82w",
-  "modified": "2023-11-17T06:31:21Z",
-  "published": "2023-11-17T06:31:21Z",
-  "aliases": [
-    "CVE-2023-48648"
-  ],
-  "details": "Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions (such as the Mkdir() function) gives universal access (0777) to created folders by default. Excessive permissions can be granted when creating a directory with permissions greater than 0755 or when the permissions argument is not specified.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48648"
-    },
-    {
-      "type": "WEB",
-      "url": "https://documentation.concretecms.org/developers/introduction/version-history/8513-release-notes"
-    },
-    {
-      "type": "WEB",
-      "url": "https://documentation.concretecms.org/developers/introduction/version-history/922-release-notes"
-    },
-    {
-      "type": "WEB",
-      "url": "https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-
-    ],
-    "severity": null,
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2023-11-17T04:15:07Z"
-  }
-}
\ No newline at end of file