Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS05OThjLXE4aGgtaDhnds4AA_nA

Concrete CMS stored XSS vulnerability in the "Top Navigator Bar" block

Concrete CMS versions 9.0.0 through 9.3.3 are affected by a stored XSS vulnerability in the "Top Navigator Bar" block. Since the "Top Navigator Bar" output was not sufficiently sanitized, a rogue administrator could add a malicious payload that could be executed when targeted users visited the home page. This does not affect versions below 9.0.0 since they do not have the Top
Navigator Bar Block. Thanks, Chu Quoc Khanh for reporting.

Permalink: https://github.com/advisories/GHSA-998c-q8hh-h8gv
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05OThjLXE4aGgtaDhnds4AA_nA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 month ago
Updated: about 1 month ago

CVSS Score: 4.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-998c-q8hh-h8gv, CVE-2024-8660
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-8660
• https://github.com/concretecms/concretecms/pull/12128
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/934-release-notes
• https://github.com/concretecms/concretecms/commit/f5a01c88fb2630db96e58dcd7f52ea41e516d4e9
• https://github.com/advisories/GHSA-998c-q8hh-h8gv

Repository: https://github.com/concretecms/concretecms
Blast Radius: 4.1

Affected Packages