Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS14OGgyLTI1NXEtamc0eM4AA_v1

Cross site scripting in Concrete CMS

Concrete CMS versions 9 through 9.3.3 and versions below 8.5.19 are vulnerable to stored XSS in the calendar event addition feature because the calendar event name was not sanitized on output. Users or groups with permission to create event calendars can embed scripts, and users or groups with permission to modify event calendars can execute scripts. 

Permalink: https://github.com/advisories/GHSA-x8h2-255q-jg4x
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14OGgyLTI1NXEtamc0eM4AA_v1
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: 18 days ago
Updated: 13 days ago

CVSS Score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-x8h2-255q-jg4x, CVE-2024-7398
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-7398
• https://github.com/concretecms/concretecms/pull/12183
• https://github.com/concretecms/concretecms/pull/12184
• https://github.com/concretecms/concretecms/commit/7c8ed0d1d9db0d7f6df7fa066e0858ea618451a5
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/934-release-notes
• https://documentation.concretecms.org/developers/introduction/version-history/8519-release-notes
• https://github.com/advisories/GHSA-x8h2-255q-jg4x

Repository: https://github.com/concretecms/concretecms
Blast Radius: 4.6

Affected Packages