GHSA-q7qr-22qw-pqgx

Cross site scripting in Concrete CMS

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-8291

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	concrete5/concrete5	>= 9.0.0, < 9.3.4	9.3.4
Packagist	concrete5/concrete5	< 8.5.19	8.5.19

Details

As written in the advisory (Markdown source, shown as plain text).

Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in Image Editor Background Color. A rogue admin could add malicious code to the Thumbnails/Add-Type.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-8291 advisory
https://github.com/concretecms/concretecms/pull/12183 web
https://github.com/concretecms/concretecms/commit/d97b43b8dd0b5578b41d2ffb5b2186a44c2c772c web
https://github.com/concretecms/concretecms/commit/dbce253166f6b10ff3e0c09e50fd395370b8b065 web
https://documentation.concretecms.org/9-x/developers/introduction/version-history/934-release-notes web
https://documentation.concretecms.org/developers/introduction/version-history/8519-release-notes web
https://github.com/concretecms/concretecms package