Skip to content
OpenAdvisories
Low · 2.4 CVE-2023-49337 EUVD-2024-0605GHSA-9xxv-q6pp-96wq

Concrete CMS Stored XSS

Published Dec 25, 2023 · Updated Aug 26, 2024 · Assigned by mitre

Package: concrete5/concrete5 Ecosystem: Packagist

Description

Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. (8.5 and earlier are unaffected.)

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist concrete5/concrete5 >= 9.0.0, < 9.2.3 9.2.3 GHSA-9xxv-q6pp-96wq

References