CVE-2024-1246
CVE-2024-1246 · Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature due to insufficient validation of administrator provided data. A rogue administrator could inject malicious code when importing images, leading to the execution of the malicious code on the website user’s browser. The Concrete CMS Security team scored this 2 with CVSS v3 vector AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N. This does not affect Concrete versions prior to version 9.
CVSS 2.0 · Baja · EPSS 0,5% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: php
Productos y versiones afectados
concrete cms
- Versiones
- ≥ 9.0.0, < 9.2.5: Afectada (patch)
Actualiza a 9.2.5
concrete5/concrete5 Packagist
- Versiones
- 9.0.0
- 9.0.0RC1
- 9.0.0RC3
- 9.0.0RC4
- 9.0.1
- 9.0.2
- 9.1.0
- 9.1.1
- 9.1.2
- 9.1.3
- 9.2.0
- 9.2.0RC2
- 9.2.1
- 9.2.2
- 9.2.3
- 9.2.4
- Intervalos de versiones afectados
- ECOSYSTEM: ≥ 9.0.0RC1, < 9.2.5
Actualiza a 9.2.5