~ / search / GHSA-qgm9-rxmq-jxmq

GHSA-qgm9-rxmq-jxmq

Concrete CMS Stored XSS in the Search Field

Source: GitHub Advisory Database (reviewed) Low CVE-2024-3181

Packages

EcosystemPackageAffectedFixed in
Packagist concrete5/concrete5 >= 9.0.0RC1, < 9.2.8 9.2.8
Packagist concrete5/concrete5 < 8.5.16 8.5.16

Details

As written in the advisory (Markdown source, shown as plain text).

Concrete CMS version 9 prior to 9.2.8 and previous versions prior to 8.5.16 are vulnerable to Stored XSS in the Search Field. Prior to the fix, stored XSS could be executed by an administrator changing a filter to which a rogue administrator had previously added malicious code. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator . Thanks Alexey Solovyev for reporting

References

External links from the advisory. They lead to third-party sites.