CVE-2024-7398: Concrete CMS Stored XSS Vulnerability in Calendar Event Feature
Summary
CVE-2024-7398: Cross site scripting in Concrete CMS. Affects concrete5/concrete5 across 2 version ranges.
< 8.5.19
>= 9.0.0, < 9.3.4
Fixed in 8.5.19 or 9.3.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Concrete CMS is an open-source content management system (CMS) that allows users to create and manage websites easily. It offers features such as customizable themes, user permissions, and various add-ons to enhance functionality. However, versions 9 through 9.3.3 and versions below 8.5.19 are vulnerable to a stored cross-site scripting (XSS) attack due to improper sanitization of calendar event names.
Vulnerability Detail
The vulnerability arises from the calendar event addition feature in Concrete CMS, where the event name input is not properly sanitized before being rendered on the output. This oversight allows users or groups with permission to create or modify event calendars to embed and execute malicious scripts. If exploited, this could lead to unauthorized actions being performed on behalf of the user, data theft, or other malicious activities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.5.198.5.19composer require concrete5/concrete5:8.5.19 -
>= 9.0.0, < 9.3.49.3.4composer require concrete5/concrete5:9.3.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, restrict permissions for users and groups who can create or modify event calendars until the software can be updated. This will help limit the potential for exploitation while a permanent fix is being implemented.
Conclusion
The stored XSS vulnerability in Concrete CMS poses a significant risk to users who can create or modify calendar events. It is crucial to update to the latest versions to safeguard against potential attacks. Implementing the recommended fixes and workarounds will help mitigate the risks associated with this vulnerability.
See every vulnerability recorded for concrete5/concrete5 →
FAQ
It is a stored cross-site scripting (XSS) vulnerability that allows attackers to inject scripts through the calendar event name.
Concrete CMS versions 9.0.0 to 9.3.3 and versions below 8.5.19 are affected by this vulnerability.
If exploited, attackers can execute scripts, potentially leading to data theft, unauthorized actions, or other malicious activities.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score of this vulnerability is 5.4, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for concrete5/concrete5.
