p PatchFirst

CVE-2024-3180

CVE-2024-3180 · Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file. Stored XSS could be caused by a rogue administrator adding malicious code to the link-text field when creating a block of type file. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator . Thanks Alexey Solovyev for reporting.

CVSS 3.1 · Low · EPSS 0.4% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • concrete cms

    Versions
    • ≥ 9.0.0, < 9.2.8: Affected (git)
    • ≥ 5.0.0, < 8.5.16: Affected (git)

    Update to 8.5.16; Update to 9.2.8

  • concrete5/concrete5 Packagist

    Versions
    • 9.0.0
    • 9.0.0RC1
    • 9.0.0RC3
    • 9.0.0RC4
    • 9.0.1
    • 9.0.2
    • 9.1.0
    • 9.1.1
    • 9.1.2
    • 9.1.3
    • 9.2.0
    • 9.2.0RC2
    • 9.2.1
    • 9.2.2
    • 9.2.3
    • 9.2.4
    • 9.2.5
    • 9.2.6
    • 9.2.7
    Affected ranges
    • ECOSYSTEM: ≥ 9.0.0RC1, < 9.2.8

    Update to 9.2.8

  • concrete5/concrete5 Packagist

    Versions
    • 8.0
    • 8.0.1
    • 8.0.2
    • 8.0.3
    • 8.1.0
    • 8.2.0
    • 8.2.0RC2
    • 8.2.1
    • 8.3.0
    • 8.3.1
    • 8.3.2
    • 8.4.0
    • 8.4.0RC3
    • 8.4.0RC4
    • 8.4.1
    • 8.4.2
    • 8.4.3
    • 8.4.4
    • 8.4.5
    • 8.5.0
    • 8.5.0RC1
    • 8.5.0RC2
    • 8.5.1
    • 8.5.10
    • 8.5.11
    • 8.5.12
    • 8.5.13
    • 8.5.14
    • 8.5.15
    • 8.5.2
    • 8.5.3
    • 8.5.4
    • 8.5.5
    • 8.5.6
    • 8.5.6RC1
    • 8.5.7
    • 8.5.8
    • 8.5.9
    Affected ranges
    • ECOSYSTEM: < 8.5.16

    Update to 8.5.16

Original sources

Check your server →