GitHub Advisoryadvisory · Packagist

GHSA-xmxj-v2q8-8qx6 Concrete CMS Stored XSS in the "Next&Previous Nav" block

MEDIUM Published 2024-09-16 Modified 2024-09-16 Official page ↗
Aliases
CVE-2024-8661
Ecosystem
Packagist
Packages
concrete5/concrete5
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-09-16

Affected packages

• Packagist concrete5/concrete5: < 8.5.19 → fixed in 8.5.19 • Packagist concrete5/concrete5: >= 9.0.0, < 9.3.4 → fixed in 9.3.4

Description

Concrete CMS versions 9.0.0 to 9.3.4 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block. A rogue administrator could add a malicious payload by executing it in the browsers of targeted users. Since the "Next&Previous Nav" block output was not sufficiently sanitized, the malicious payload could be executed in the browsers of targeted users.

Related

Alias · CVE (1)

  • CVE-2024-8661 Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References