Skip to content
OpenAdvisories
Low · 3.5 CVE-2023-28819 EUVD-2023-1182GHSA-474f-mcjv-pgrm

Concrete CMS (previously concrete5) is vulnerable to stored XSS in uploaded file and folder names

Published Apr 28, 2023 · Updated Aug 2, 2024 · Assigned by mitre

Package: concrete5/concrete5 Ecosystem: Packagist

Description

Concrete CMS (previously concrete5) versions 8.5.12 and below, 9.0.0 through 9.0.2 is vulnerable to Stored XSS in uploaded file and folder names.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist concrete5/concrete5 < 9.1.0 9.1.0 GHSA-474f-mcjv-pgrm

References