GitHub Advisoryadvisory · Packagist

GHSA-q5wx-m95r-4cgc Concrete CMS Stored Cross-site Scripting vulnerability

MEDIUM Published 2024-08-12 Modified 2025-01-21 Official page ↗
Aliases
CVE-2024-4350
Ecosystem
Packagist
Packages
concrete5/concrete5
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N
Weaknesses
CWE-20, CWE-79
Reviewed
2024-08-19

Affected packages

• Packagist concrete5/concrete5: < 8.5.18 → fixed in 8.5.18 • Packagist concrete5/concrete5: >= 9.0.0RC1, < 9.3.3 → fixed in 9.3.3

Description

Concrete CMS versions 9.0.0 to 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in RSS Displayer when user input is stored and later embedded into responses. A rogue administrator could inject malicious code into fields due to insufficient input validation.

Related

Alias · CVE (1)

  • CVE-2024-4350 Concrete CMS versions 9.0.0 to 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in RSS Displayer when user input is stored and later… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References