CVE-2024-1247
Description
Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS via the Role Name field since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Role Name field which might be executed when users visit the affected page. The Concrete CMS Security team scored this 2 with CVSS v3 vector AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator . Concrete versions below 9 do not include group types so they are not affected by this vulnerability.
How to fix
- concretecms concrete_cms9.2.5 or later
- concrete5/concrete59.2.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| concretecms concrete_cms | 9.0.0 ≤ v < 9.2.5 | 9.2.5 |
| concrete5/concrete5Packagist | 9.0.0RC1 ≤ v < 9.2.5 | 9.2.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.