GHSA-6xx7-r8x4-fpjp

ConcreteCMS Cross-site Scripting vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-44765

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	concrete5/concrete5	< 9.2.2	9.2.2

Details

As written in the advisory (Markdown source, shown as plain text).

A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to Plural Handle of the Data Objects from System & Settings.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-44765 advisory
https://github.com/concretecms/concretecms/pull/11746 web
https://github.com/concretecms/concretecms/pull/11746/commits/0f0564232e0a49719d0bdff6223539b624f116ee web
https://github.com/concretecms/concretecms/pull/11746/commits/92bcc208078571f4beda38cb0952f8e99887737a web
https://github.com/concretecms/concretecms package
https://github.com/sromanhu/ConcreteCMS-Stored-XSS---Associations web
https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release web