CVE-2024-7512: Stored Cross-site Scripting in Concrete CMS
Summary
CVE-2024-7512: Concrete CMS vulnerable to Stored Cross-site Scripting. Affects concrete5/concrete5 versions >= 9.0.0RC1, < 9.3.3. Fixed in 9.3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Concrete CMS is an open-source content management system that allows users to create and manage websites. It provides a user-friendly interface and a wide range of features for website development. However, versions 9.0.0 through 9.3.2 of Concrete CMS are vulnerable to a stored cross-site scripting (XSS) attack in Board instances. This vulnerability can be exploited by a rogue administrator to inject malicious code into the system.
Vulnerability Detail
The stored XSS vulnerability in Concrete CMS allows an attacker with administrative privileges to inject malicious code into Board instances. This can lead to the execution of arbitrary JavaScript code in the context of other users visiting the affected pages. The impact of this vulnerability can range from defacement of the website to the theft of sensitive user information. The vulnerability is rated as low severity with a CVSS score of 2.0.
How To Fix
Minimum fixed version
9.3.3
This is the first release that contains the fix.
composer require concrete5/concrete5:9.3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of Concrete CMS to ensure the security of the system.
Conclusion
Concrete CMS versions 9.0.0 through 9.3.2 are vulnerable to a stored XSS attack in Board instances. This can allow a rogue administrator to inject malicious code and potentially compromise the security of the system. Users are advised to upgrade to version 9.3.3 or later to mitigate this vulnerability.
See every vulnerability recorded for concrete5/concrete5 →
FAQ
Concrete CMS is an open-source content management system used for website development.
Versions 9.0.0 through 9.3.2 of Concrete CMS are affected by this vulnerability.
The vulnerability allows an attacker to inject malicious code and potentially execute arbitrary JavaScript on the affected website.
To fix this vulnerability, upgrade to version 9.3.3 or later of Concrete CMS.
There is no known workaround for this vulnerability. Upgrading to the latest version is recommended.
Related vulnerabilities
Recent vulnerabilities recorded for concrete5/concrete5.
