CVE-2024-2753
Concrete CMS version 9 below 9.2.8 and below 8.5.16 is vulnerable to stored XSS on the calendar color settings screen
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Concrete CMS version 9 below 9.2.8 and below 8.5.16 is vulnerable to stored XSS on the calendar color settings screen
Concrete CMS version 9 before 9.2.8 and previous versions prior to 8.5.16 is vulnerable to Stored XSS on the calendar color settings screen since Information input by the user is output without escaping. A rogue administrator could inject malicious javascript into the Calendar Color Settings screen which might be executed when users visit the affected page. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 2.0 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N&version=3.1 https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator Thank you Rikuto Tauchi for reporting
Reserved 2024-03-20 | Published 2024-04-03 | Updated 2024-08-30 | Assigner ConcreteCMSCWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Rikuto Tauchi
documentation.concretecms.org/...y4xLjE3MTIxNjY3MDcuMC4wLjA.
documentation.concretecms.org/...y4xLjE3MTIxNjY2ODEuMC4wLjA.
Support options
