CVE-2024-8291: Concrete CMS Stored XSS Vulnerability in Image Editor Background Color
Summary
CVE-2024-8291: Cross site scripting in Concrete CMS. Affects concrete5/concrete5 across 2 version ranges.
< 8.5.19
>= 9.0.0, < 9.3.4
Fixed in 8.5.19 or 9.3.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Concrete CMS is an open-source content management system that enables users to create and manage websites with ease. It offers features such as a user-friendly interface, customizable themes, and a robust set of tools for developers. However, versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to a stored cross-site scripting (XSS) issue, which can be exploited by malicious users.
Vulnerability Detail
The vulnerability arises from the Image Editor's Background Color feature, where a rogue admin can inject malicious code into the Thumbnails/Add-Type section. This stored XSS can lead to unauthorized actions being performed on behalf of legitimate users, potentially compromising sensitive data and user accounts. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and can have a CVSS score of 4.8, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.5.198.5.19composer require concrete5/concrete5:8.5.19 -
>= 9.0.0, < 9.3.49.3.4composer require concrete5/concrete5:9.3.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, restrict admin access to trusted users only, and monitor any changes made in the Image Editor. This can help mitigate the risk until the software is updated.
Conclusion
The stored XSS vulnerability in Concrete CMS poses a significant risk to users, particularly those with admin access. It is crucial to update to the latest versions to safeguard against potential exploits. Additionally, utilizing tools like Vulert can help monitor and alert for vulnerabilities in real-time.
See every vulnerability recorded for concrete5/concrete5 →
FAQ
The vulnerability allows a rogue admin to inject malicious scripts, potentially compromising user data and leading to unauthorized actions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are affected by this vulnerability.
Yes, you can restrict admin access to trusted users and monitor changes in the Image Editor as a temporary measure.
The CVSS score of this vulnerability is 4.8, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for concrete5/concrete5.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
