CVE-2023-49337: Concrete CMS Stored XSS
Summary
CVE-2023-49337: Concrete CMS Stored XSS. Affects concrete5/concrete5 versions >= 9.0.0, < 9.2.3. Fixed in 9.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Concrete CMS is a content management system that allows users to create and manage websites. It provides a user-friendly interface and a range of features for website customization. However, versions before 9.2.3 are vulnerable to a Stored XSS (Cross-Site Scripting) attack on the Admin Dashboard via the /dashboard/system/basics/name endpoint. This vulnerability allows an attacker to inject malicious scripts into the website, potentially compromising user data and performing unauthorized actions. Versions 8.5 and earlier are not affected by this vulnerability.
Vulnerability Detail
The Stored XSS vulnerability in Concrete CMS allows an attacker to inject malicious scripts into the Admin Dashboard. This can be exploited by tricking an authenticated administrator into visiting a specially crafted URL or clicking on a malicious link. Once the script is executed, the attacker can steal sensitive information, such as login credentials, or perform unauthorized actions on behalf of the administrator. The impact of this vulnerability can range from data theft to complete website takeover. The vulnerability has a CVSS score of 2.4, indicating a low severity level.
How To Fix
Minimum fixed version
9.2.3
This is the first release that contains the fix.
composer require concrete5/concrete5:9.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate update is not possible, a temporary workaround is to disable access to the /dashboard/system/basics/name endpoint. This can be achieved by modifying the server configuration or using a web application firewall (WAF) to block requests to this specific URL. However, this workaround should only be considered as a temporary measure, and updating to the latest version is still the recommended solution.
Conclusion
The Stored XSS vulnerability in Concrete CMS poses a risk to the security and integrity of websites using affected versions. It is crucial for users to update their installations to version 9.2.3 or later to mitigate the risk of exploitation. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for concrete5/concrete5 →
FAQ
Concrete CMS is a content management system that allows users to create and manage websites. It provides a user-friendly interface and a range of features for website customization.
Stored XSS (Cross-Site Scripting) is a type of vulnerability that allows an attacker to inject malicious scripts into a website. These scripts are then executed by unsuspecting users, potentially leading to data theft or unauthorized actions.
Versions of Concrete CMS before 9.2.3 are vulnerable to the Stored XSS attack. Versions 8.5 and earlier are not affected.
The vulnerability allows an attacker to compromise user data, steal sensitive information, and perform unauthorized actions on behalf of an administrator. The impact can range from data theft to complete website takeover.
To protect your installation, it is recommended to update Concrete CMS to version 9.2.3 or later. Additionally, implementing security best practices, such as using strong passwords and regularly monitoring for suspicious activity, can help mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for concrete5/concrete5.
