CVE-2024-3178
Description
Concrete CMS versions 9 below 9.2.8 and versions below 8.5.16 are vulnerable to Cross-site Scripting (XSS) in the Advanced File Search Filter. Prior to the fix, a rogue administrator could add malicious code in the file manager because of insufficient validation of administrator provided data. All administrators have access to the File Manager and hence could create a search filter with the malicious code attached. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator .
How to fix
- concretecms concrete_cms8.5.16, 9.2.8 or later
- concrete5/concrete59.2.8, 8.5.16 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| concretecms concrete_cms | v < 8.5.16, 9.0.0 ≤ v < 9.2.8 | 8.5.16, 9.2.8 |
| concrete5/concrete5Packagist | 9.0.0RC1 ≤ v < 9.2.8, v < 8.5.16 | 9.2.8, 8.5.16 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.