CVE-2024-1247: Stored XSS vulnerability in Concrete CMS
Summary
CVE-2024-1247: Concrete CMS vulnerable to stored XSS via the Role Name field. Affects concrete5/concrete5 versions >= 9.0.0RC1, < 9.2.5. Fixed in 9.2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Concrete CMS is an open-source content management system that allows users to create and manage websites. It provides various features such as user management, role-based access control, and content editing. Concrete CMS version 9 before 9.2.5 is affected by a stored XSS vulnerability in the Role Name field. This vulnerability arises due to insufficient validation of user-provided data. An attacker with administrator privileges can inject malicious code into the Role Name field, which may be executed when users visit the affected page. Concrete versions below 9 are not impacted by this vulnerability.
Vulnerability Detail
The stored XSS vulnerability in Concrete CMS allows a rogue administrator to inject malicious code into the Role Name field. This field lacks proper validation, enabling the execution of the injected code when users access the affected page. This vulnerability poses a risk to the confidentiality and integrity of user data, as well as the availability of the affected system. The Concrete CMS Security team has assigned a CVSS v3 score of 2.0 to this vulnerability.
How To Fix
Minimum fixed version
9.2.5
This is the first release that contains the fix.
composer require concrete5/concrete5:9.2.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the Role Name field or restrict access to it for administrators. This can be achieved by modifying the application's code or configuration. However, it is strongly recommended to apply the official fix by upgrading to the latest version of Concrete CMS.
Conclusion
Concrete CMS version 9 before 9.2.5 is vulnerable to a stored XSS vulnerability in the Role Name field. To mitigate this issue, users should upgrade to Concrete CMS version 9.2.5 or later. In the meantime, a temporary workaround is to disable or restrict access to the Role Name field. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for concrete5/concrete5 →
FAQ
Concrete CMS is an open-source content management system that allows users to create and manage websites. It provides various features such as user management, role-based access control, and content editing.
A stored XSS vulnerability occurs when user-supplied data is not properly validated or sanitized before being stored and later displayed to other users. This allows an attacker to inject malicious code that will be executed when other users access the affected page.
An attacker with administrator privileges can exploit this vulnerability by injecting malicious code into the Role Name field. When other users, including administrators, access the affected page, the injected code will be executed, potentially leading to unauthorized actions or data theft.
No, only Concrete CMS version 9 before 9.2.5 is affected by this vulnerability. Versions below 9 do not include the Role Name field, so they are not impacted.
The Concrete CMS Security team has assigned a CVSS v3 score of 2.0 to this vulnerability. This score indicates a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for concrete5/concrete5.
