GHSA-fgxj-g7x3-85cq

Stored cross site scripting in RSS displayer

Source: GitHub Advisory Database (reviewed) Low CVE-2023-28820

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	concrete5/concrete5	< 9.1.0	9.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was not sanitized.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-28820 advisory
https://github.com/concretecms/concretecms package
https://github.com/concretecms/concretecms/releases web
https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20 web