Description
Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | concrete5/concrete5 | < 8.5.5 | 8.5.5 | GHSA-7388-7vq2-m4f4 |