CVE-2024-3179: Concrete CMS Stored XSS in the Custom Class page editing
Summary
CVE-2024-3179: Concrete CMS Stored XSS in the Custom Class page editing. Affects concrete5/concrete5 across 2 version ranges.
< 8.5.16
>= 9.0.0RC1, < 9.2.8
Fixed in 8.5.16 or 9.2.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Concrete CMS is an open-source content management system that allows users to create and manage websites. It provides a user-friendly interface and various features for website customization. However, versions 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to Stored XSS in the Custom Class page editing. This vulnerability allows a rogue administrator to insert malicious code in the custom class field due to insufficient validation of administrator-provided data.
Vulnerability Detail
The Stored XSS vulnerability in Concrete CMS allows an attacker with administrator privileges to inject malicious code into the custom class field. This can lead to the execution of arbitrary JavaScript code in the context of other users visiting the affected page. The impact of this vulnerability can range from stealing sensitive information, such as login credentials, to performing actions on behalf of the victim user. The Concrete CMS security team has assigned a CVSS v3.1 score of 3.1 to this vulnerability.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.5.168.5.16composer require concrete5/concrete5:8.5.16 -
>= 9.0.0RC1, < 9.2.89.2.8composer require concrete5/concrete5:9.2.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patches or upgrade to the latest version of Concrete CMS.
Conclusion
Concrete CMS versions 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to Stored XSS in the Custom Class page editing. It is crucial for users of Concrete CMS to upgrade to the latest version or apply the official patches to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for concrete5/concrete5 →
FAQ
Concrete CMS is an open-source content management system used for creating and managing websites.
Stored XSS (Cross-Site Scripting) is a type of vulnerability that allows an attacker to inject malicious code into a website, which is then executed by other users visiting the affected page.
The impact of this vulnerability can range from stealing sensitive information, such as login credentials, to performing actions on behalf of the victim user.
To fix this vulnerability, users of Concrete CMS should upgrade to the latest version, which includes proper validation of the custom class field.
There is no known workaround for this vulnerability. It is recommended to apply the official patches or upgrade to the latest version of Concrete CMS.
References
Related vulnerabilities
Recent vulnerabilities recorded for concrete5/concrete5.
