GHSA-wrp2-6v6j-hfmgmedium5.4
ConcreteCMS vulnerable to Stored Cross-site Scripting
Impact
Concrete CMS v9.2.1 is affected by Arbitrary File Upload vulnerability via the Thumbnail file upload, which allows Cross-Site Scripting (XSS).
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
concrete5/concrete5 Packagist
| Affected range | Recorded fix |
|---|---|
| Earlier releases through 9.2.1 (inclusive)Ecosystem versions | Not recorded |
Version evidence: OSV · GHSA-wrp2-6v6j-hfmg
View original version evidence (57 explicit versions)
Original source description
Concrete CMS v9.2.1 is affected by Arbitrary File Upload vulnerability via the Thumbnail file upload, which allows Cross-Site Scripting (XSS).
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2023-44763
- Source reference github.com/concretecms/concretecms
- Source reference github.com/sromanhu/ConcreteCMS-Arbitrary-file-upload-Thumbnail
- Source reference web.archive.org/web/20231026034159/https://documentation.concretecms.org/user-guide/editors-reference/dashboard/system-and-maintenance/files/allowed-file-types
- Security advisory www.concretecms.org/about/project-news/security/security-advisory-2023-10-25-concrete-cms-rejects-cve-2023-44763