GitHub Advisoryadvisory · Packagist

GHSA-q7qr-22qw-pqgx Cross site scripting in Concrete CMS

MEDIUM Published 2024-09-25 Modified 2025-01-21 Official page ↗
Aliases
CVE-2024-8291
Ecosystem
Packagist
Packages
concrete5/concrete5
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-22, CWE-79
Reviewed
2024-09-25

Affected packages

• Packagist concrete5/concrete5: >= 9.0.0, < 9.3.4 → fixed in 9.3.4 • Packagist concrete5/concrete5: < 8.5.19 → fixed in 8.5.19

Description

Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in Image Editor Background Color.  A rogue admin could add malicious code to the Thumbnails/Add-Type.

Related

Alias · CVE (1)

  • CVE-2024-8291 Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in Image Editor Background Color. vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References