Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2024-3178GHSA-XWRH-QXMC-X8C8

Concrete CMS versions 9 below 9.2.8 and versions below 8.5.16 are vulnerable to Cross-site Scripting (XSS) in the Advanced File Search Filter

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 9.2.8, 8.5.16
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

Concrete CMS versions 9 below 9.2.8 and versions below 8.5.16 are vulnerable to Cross-site Scripting (XSS) in the Advanced File Search Filter. Prior to the fix, a rogue administrator could add malicious code in the file manager because of insufficient validation of administrator provided data. All administrators have access to the File Manager and hence could create a search filter with the malicious code attached. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator .

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  3. Record last updated

Affected versions

  • Concrete CMS Concrete CMS

    From 9.0.0 · fixed in 9.2.8; From 5.0.0 · fixed in 8.5.16

  • concrete5/concrete5Packagist

    From 9.0.0RC1 · fixed in 9.2.8

  • concrete5/concrete5Packagist

    fixed in 8.5.16

References 2

documentation.concretecms.org