CVE-2024-4350: Stored Cross-site Scripting in Concrete CMS
Summary
CVE-2024-4350: Concrete CMS Stored Cross-site Scripting vulnerability. Affects concrete5/concrete5 across 2 version ranges.
< 8.5.18
>= 9.0.0RC1, < 9.3.3
Fixed in 8.5.18 or 9.3.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Concrete CMS is an open-source content management system that allows users to create and manage websites. It provides a user-friendly interface and various features for website customization. However, versions 9.0.0 to 9.3.2 and below 8.5.18 of Concrete CMS are vulnerable to a Stored Cross-site Scripting (XSS) vulnerability in the RSS Displayer component. This vulnerability arises due to insufficient input validation, allowing a rogue administrator to inject malicious code into fields.
Vulnerability Detail
The Stored XSS vulnerability in Concrete CMS allows an attacker with administrator privileges to inject malicious code into fields that are later embedded into responses. This can lead to the execution of arbitrary JavaScript code in the context of other users visiting the affected website. The impact of this vulnerability can range from unauthorized access to sensitive information to complete website takeover. The vulnerability has a CVSS score of 3.0, indicating a low severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.5.188.5.18composer require concrete5/concrete5:8.5.18 -
>= 9.0.0RC1, < 9.3.39.3.3composer require concrete5/concrete5:9.3.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Concrete CMS to the patched versions mentioned above.
Conclusion
Concrete CMS versions 9.0.0 to 9.3.2 and below 8.5.18 are vulnerable to a Stored Cross-site Scripting (XSS) vulnerability in the RSS Displayer component. This can allow a rogue administrator to inject malicious code into fields, potentially leading to unauthorized access or website takeover. It is recommended to update Concrete CMS to the patched versions to mitigate this vulnerability.
See every vulnerability recorded for concrete5/concrete5 →
FAQ
Concrete CMS is an open-source content management system used for creating and managing websites.
Stored Cross-site Scripting (XSS) is a type of vulnerability that allows an attacker to inject malicious code into a website, which is then stored and executed when other users visit the affected page.
The impact of this vulnerability can range from unauthorized access to sensitive information to complete website takeover.
To fix this vulnerability, update Concrete CMS to version 8.5.18 or above for versions below 8.5.18, and to version 9.3.3 or above for versions between 9.0.0 and 9.3.2.
No, there is no known workaround for this vulnerability. It is crucial to update Concrete CMS to the patched versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for concrete5/concrete5.
