CVE-2024-7394: Stored XSS in Concrete CMS getAttributeSetName
Summary
CVE-2024-7394: Concrete CMS Stored XSS in getAttributeSetName. Affects concrete5/concrete5 across 2 version ranges.
< 8.5.18
>= 9.0.0, < 9.3.3
Fixed in 8.5.18 or 9.3.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Concrete CMS is an open-source content management system that allows users to create and manage websites. It is widely used for its user-friendly interface and extensive customization options. However, versions 9 through 9.3.2 and below 8.5.18 of Concrete CMS are vulnerable to a stored cross-site scripting (XSS) attack in the getAttributeSetName() function. This function is responsible for retrieving the name of an attribute set in the CMS. A malicious administrator could exploit this vulnerability to inject and execute malicious code on the affected website.
Vulnerability Detail
The stored XSS vulnerability in Concrete CMS allows an attacker with administrator privileges to inject malicious code into the getAttributeSetName() function. This can occur when the administrator interacts with the CMS and provides input that is not properly sanitized or validated. When the injected code is executed, it can lead to various consequences, such as stealing sensitive user information, modifying website content, or performing unauthorized actions on behalf of the administrator. The vulnerability has a CVSS score of 2.0, indicating a low severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.5.188.5.18composer require concrete5/concrete5:8.5.18 -
>= 9.0.0, < 9.3.39.3.3composer require concrete5/concrete5:9.3.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can disable the affected functionality or restrict access to the vulnerable code. This can be achieved by modifying the CMS configuration or implementing custom access controls. However, applying the recommended fix by upgrading to a fixed version is the best long-term solution.
Conclusion
Concrete CMS versions 9 through 9.3.2 and below 8.5.18 are vulnerable to a stored XSS attack in the getAttributeSetName() function. This allows a malicious administrator to inject and execute arbitrary code on the affected website. Upgrading to a fixed version of Concrete CMS is recommended to mitigate this vulnerability.
See every vulnerability recorded for concrete5/concrete5 →
FAQ
Concrete CMS is an open-source content management system used for creating and managing websites.
Versions 9 through 9.3.2 and below 8.5.18 of Concrete CMS are vulnerable to this stored XSS vulnerability.
This vulnerability allows a malicious administrator to inject and execute arbitrary code on the affected website, potentially leading to unauthorized actions, data theft, or website defacement.
Yes, upgrading to a fixed version of Concrete CMS (8.5.18 or later for versions below 8.5.18, and 9.3.3 or later for versions 9.0.0 through 9.3.2) will address this vulnerability.
The CVSS score of this vulnerability is 2.0, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for concrete5/concrete5.
