GitHub Advisoryadvisory · Packagist

GHSA-fgxj-g7x3-85cq Stored cross site scripting in RSS displayer

LOW Published 2023-04-28 Modified 2023-05-01 Official page ↗
Aliases
CVE-2023-28820
Ecosystem
Packagist
Packages
concrete5/concrete5
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-79
Reviewed
2023-05-01

Affected packages

• Packagist concrete5/concrete5: < 9.1.0 → fixed in 9.1.0

Description

Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was not sanitized.

Related

Alias · CVE (1)

  • CVE-2023-28820 Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References