Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS00NzRmLW1janYtcGdybc4AAzA4

Concrete CMS (previously concrete5) is vulnerable to stored XSS in uploaded file and folder names

Concrete CMS (previously concrete5) before 9.1 is vulnerable to Stored XSS in uploaded file and folder names.

Permalink: https://github.com/advisories/GHSA-474f-mcjv-pgrm
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00NzRmLW1janYtcGdybc4AAzA4
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: about 1 year ago
Updated: 5 months ago

CVSS Score: 3.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Identifiers: GHSA-474f-mcjv-pgrm, CVE-2023-28819
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-28819
• https://github.com/concretecms/concretecms/releases
• https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20
• https://github.com/concretecms/concretecms/pull/11749
• https://github.com/concretecms/concretecms/releases/tag/8.5.13
• https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release
• https://github.com/advisories/GHSA-474f-mcjv-pgrm

Repository: https://github.com/concretecms/concretecms
Blast Radius: 3.0

Affected Packages