CVEvulnerability

CVE-2024-3181

4.8 MEDIUM Published 2024-04-03 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-04-03
Last modified
2026-06-17
Assigner
ff5b8ace-8b95-4078-9743-eac1ca5451de
CVSS 3.1 (ff5b8ace-8b95-4078-9743-eac1ca5451de)
3.1 LOW — CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L
CVSS 3.1 ([email protected])
4.8 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79

Description

Concrete CMS version 9 prior to 9.2.8 and previous versions prior to 8.5.16 are vulnerable to Stored XSS in the Search Field. Prior to the fix, stored XSS could be executed by an administrator changing a filter to which a rogue administrator had previously added malicious code. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator . Thanks Alexey Solovyev for reporting

Affected configurations

• concretecms concrete cms (< 8.5.16) • concretecms concrete cms (>= 9.0.0 < 9.2.8)

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References