CVE-2024-3181: Concrete CMS Stored XSS in the Search Field
Summary
CVE-2024-3181: Concrete CMS Stored XSS in the Search Field. Affects concrete5/concrete5 across 2 version ranges.
< 8.5.16
>= 9.0.0RC1, < 9.2.8
Fixed in 8.5.16 or 9.2.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Concrete CMS is an open-source content management system that allows users to create and manage websites. It provides a user-friendly interface and various features for website customization. However, versions prior to 9.2.8 and 8.5.16 are vulnerable to a Stored XSS (Cross-Site Scripting) attack in the Search Field. This vulnerability allows an attacker to inject malicious code into the search filter, which can be executed when an administrator performs a search. The Concrete CMS security team has assigned a CVSS v3.1 score of 3.1 to this vulnerability.
Vulnerability Detail
The vulnerability arises from a lack of proper input sanitization in the search filter functionality of Concrete CMS. An attacker with administrator privileges can modify a filter that has been previously tampered with by a rogue administrator, allowing them to inject and execute arbitrary JavaScript code. This can lead to various security risks, including unauthorized access, data theft, and further exploitation of the system. The severity of this vulnerability is considered low.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.5.168.5.16composer require concrete5/concrete5:8.5.16 -
>= 9.0.0RC1, < 9.2.89.2.8composer require concrete5/concrete5:9.2.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed versions is not immediately feasible, a temporary workaround is to restrict access to the search functionality for administrators or limit the use of the search feature altogether. This can be achieved by modifying the permissions or disabling the search functionality until the upgrade can be performed.
Conclusion
Concrete CMS versions prior to 9.2.8 and 8.5.16 are vulnerable to a Stored XSS attack in the Search Field. It is crucial to update to the fixed versions or apply the recommended workaround to mitigate the risk of exploitation. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for concrete5/concrete5 →
FAQ
Concrete CMS is an open-source content management system used for creating and managing websites.
Stored XSS (Cross-Site Scripting) is a type of vulnerability that allows an attacker to inject malicious code into a website or application, which is then stored and executed by other users.
The vulnerability occurs due to a lack of proper input sanitization in the search filter functionality of Concrete CMS, allowing an attacker to inject and execute arbitrary JavaScript code.
The potential risks include unauthorized access, data theft, and further exploitation of the system by executing malicious code.
To mitigate this vulnerability, it is recommended to update Concrete CMS to the fixed versions (9.2.8 or 8.5.16) or restrict access to the search functionality until the upgrade can be performed.
References
Related vulnerabilities
Recent vulnerabilities recorded for concrete5/concrete5.
