CVE-2024-8660
CVE-2024-8660 · Stored XSS in the "Top Navigator Bar" block
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Concrete CMS versions 9.0.0 through 9.3.3 are affected by a stored XSS vulnerability in the "Top Navigator Bar" block. Since the "Top Navigator Bar" output was not sufficiently sanitized, a rogue administrator could add a malicious payload that could be executed when targeted users visited the home page.The Concrete CMS Security Team gave this vulnerability a CVSS v4 score of 4.6 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N . This does not affect versions below 9.0.0 since they do not have the Top Navigator Bar Block. Thanks, Chu Quoc Khanh for reporting.
CVSS 4.6 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
concrete cms
- Versions
- ≥ 9.0.0, < 9.3.4: Affected (git)
Update to 9.3.4
concrete5/concrete5 Packagist
- Versions
- 9.0.0
- 9.0.1
- 9.0.2
- 9.1.0
- 9.1.1
- 9.1.2
- 9.1.3
- 9.2.0
- 9.2.0RC2
- 9.2.1
- 9.2.2
- 9.2.3
- 9.2.4
- 9.2.5
- 9.2.6
- 9.2.7
- 9.2.8
- 9.2.9
- 9.3.0
- 9.3.1
- 9.3.2
- Affected ranges
- ECOSYSTEM: ≥ 9.0.0, < 9.3.3
Update to 9.3.3