Skip to content
OpenAdvisories
Medium · 4.8 CVE-2023-48650 EUVD-2024-0758GHSA-x577-gcc9-9xjj

Concrete CMS Stored XSS in Layout Preset Name

Published Dec 25, 2023 · Updated Aug 2, 2024 · Assigned by mitre

Package: concrete5/concrete5 Ecosystem: Packagist

Description

Concrete CMS before 8.5.14 and 9 before 9.2.3 is vulnerable to an admin adding a stored XSS payload via the Layout Preset name.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist concrete5/concrete5 < 8.5.14 8.5.14 GHSA-x577-gcc9-9xjj
Packagist concrete5/concrete5 >= 9.0.0, < 9.2.3 9.2.3 GHSA-x577-gcc9-9xjj

References