Concrete CMS Stored Cross-site Scripting Vulnerability in concrete5/concrete5
Summary
CVE-2024-2179: Concrete CMS Stored Cross-site Scripting vulnerability. Affects concrete5/concrete5 versions < 9.2.7. Fixed in 9.2.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Concrete CMS is an open-source content management system that allows users to create and manage websites. It provides a user-friendly interface and a wide range of features for website development. The concrete5 package, specifically version 9 before 9.2.7, is affected by a Stored Cross-site Scripting (XSS) vulnerability. This vulnerability arises due to insufficient validation of user-provided data in the Name field of a Group type. Malicious code can be injected by a rogue administrator into the Name field, which may be executed when users visit the affected page. Concrete versions below 9 do not include group types and are not affected by this vulnerability.
Vulnerability Detail
The Stored XSS vulnerability in Concrete CMS version 9 before 9.2.7 allows a rogue administrator to inject malicious code into the Name field of a Group type. This field lacks sufficient validation, enabling the execution of the injected code when users access the affected page. The impact of this vulnerability can range from unauthorized access to sensitive information to the execution of arbitrary code on the user's browser. The Concrete CMS security team has assigned a CVSS v3.1 score of 2.2 to this vulnerability, indicating a low severity level.
How To Fix
Minimum fixed version
9.2.7
This is the first release that contains the fix.
composer require concrete5/concrete5:9.2.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to Concrete CMS version 9.2.7 or later.
Conclusion
Concrete CMS version 9 before 9.2.7 is vulnerable to a Stored XSS vulnerability in the Name field of a Group type. Upgrading to version 9.2.7 or later is recommended to fix this vulnerability. No known workarounds exist for this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for concrete5/concrete5 →
FAQ
Concrete CMS is an open-source content management system used for creating and managing websites.
Stored XSS is a type of vulnerability that allows an attacker to inject malicious code into a website, which is then stored and executed when users access the affected page.
A rogue administrator can exploit this vulnerability by injecting malicious code into the Name field of a Group type in Concrete CMS. When users visit the affected page, the injected code may be executed, leading to potential security breaches.
The impact of this vulnerability can range from unauthorized access to sensitive information to the execution of arbitrary code on the user's browser.
To mitigate this vulnerability, it is crucial to upgrade to Concrete CMS version 9.2.7 or later, as it includes the necessary validation enhancements to prevent the execution of injected code.
Related vulnerabilities
Recent vulnerabilities recorded for concrete5/concrete5.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
