CVE-2023-48650: Stored XSS in Concrete CMS Layout Preset Name
Summary
CVE-2023-48650: Concrete CMS Stored XSS in Layout Preset Name. Affects concrete5/concrete5 across 2 version ranges.
< 8.5.14
>= 9.0.0, < 9.2.3
Fixed in 8.5.14 or 9.2.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Concrete CMS is an open-source content management system designed for building and managing websites. It provides a user-friendly interface and a range of features for creating and customizing web pages. The vulnerability in question affects versions before 8.5.14 and 9 before 9.2.3 of Concrete CMS. This vulnerability allows an admin user to inject a stored cross-site scripting (XSS) payload through the Layout Preset name.
Vulnerability Detail
The vulnerability arises from a lack of proper input sanitization in the Layout Preset name field. An attacker with admin privileges can exploit this vulnerability by creating a Layout Preset with a malicious payload in its name. When the preset is rendered or displayed, the payload gets executed in the context of other users accessing the affected page. This can lead to various consequences, including the theft of sensitive information, session hijacking, or the injection of further malicious code.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.5.148.5.14composer require concrete5/concrete5:8.5.14 -
>= 9.0.0, < 9.2.39.2.3composer require concrete5/concrete5:9.2.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can manually inspect and sanitize the Layout Preset names to remove any suspicious or potentially harmful content. Additionally, implementing a web application firewall (WAF) can help mitigate the risk of XSS attacks by filtering and blocking malicious payloads.
Conclusion
The stored XSS vulnerability in Concrete CMS's Layout Preset name field can have serious security implications for affected installations. It is essential to promptly update to the fixed versions and ensure the sanitization of existing Layout Presets. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for concrete5/concrete5 →
FAQ
Concrete CMS is an open-source content management system used for building and managing websites. It offers a user-friendly interface and various features for creating and customizing web pages.
Versions before 8.5.14 and 9 before 9.2.3 of Concrete CMS are vulnerable to this stored XSS issue.
Stored XSS (Cross-Site Scripting) is a type of vulnerability that allows an attacker to inject malicious scripts or code into a web application. These scripts are then stored and executed when other users access the affected page, potentially leading to various security risks.
Exploiting this vulnerability can result in the theft of sensitive information, session hijacking, or the injection of further malicious code. It can also compromise the integrity and trustworthiness of the affected website.
To protect your installation, it is crucial to update to the latest version of Concrete CMS (8.5.14 or 9.2.3). Additionally, regularly reviewing and sanitizing Layout Presets can help prevent the execution of malicious code.
References
Related vulnerabilities
Recent vulnerabilities recorded for concrete5/concrete5.
