GHSA-7388-7vq2-m4f4
Concrete CMS Cross-site Scripting via Survey Blocks
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | concrete5/concrete5 | < 8.5.5 | 8.5.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct Cross-site Scripting (XSS) attacks via a crafted survey block. This requires at least Editor privileges.
References
External links from the advisory. They lead to third-party sites.