GitHub Advisoryadvisory · Packagist

GHSA-x8h2-255q-jg4x Cross site scripting in Concrete CMS

MEDIUM Published 2024-09-25 Modified 2025-01-21 Official page ↗
Aliases
CVE-2024-7398
Ecosystem
Packagist
Packages
concrete5/concrete5
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-09-25

Affected packages

• Packagist concrete5/concrete5: >= 9.0.0, < 9.3.4 → fixed in 9.3.4 • Packagist concrete5/concrete5: < 8.5.19 → fixed in 8.5.19

Description

Concrete CMS versions 9 through 9.3.3 and versions below 8.5.19 are vulnerable to stored XSS in the calendar event addition feature because the calendar event name was not sanitized on output. Users or groups with permission to create event calendars can embed scripts, and users or groups with permission to modify event calendars can execute scripts.

Related

Alias · CVE (1)

  • CVE-2024-7398 Concrete CMS versions 9 through 9.3.3 and versions below 8.5.19 are vulnerable to stored XSS in the calendar event addition feature because… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References