LOW3.5
GHSA-36fr-3wg8-q5v8
Concrete CMS Cross-site Scripting vulnerability
Quick fix
GHSA-36fr-3wg8-q5v8 — concrete5/concrete5: upgrade to the fixed version with the command below.
composer require concrete5/concrete5:^8.5.13Details
Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows stored XSS on the Admin page via an uploaded file name.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/concrete5/concrete5
Introduced in:
0Fixed in: 8.5.13Fix
composer require concrete5/concrete5:^8.5.13Packagist/concrete5/concrete5
Introduced in:
9.0.0Fixed in: 9.2.2Fix
composer require concrete5/concrete5:^9.2.2References
- https://nvd.nist.gov/vuln/detail/CVE-2023-48649[ADVISORY]
- https://github.com/concretecms/concretecms/pull/11695[WEB]
- https://github.com/concretecms/concretecms/pull/11739[WEB]
- https://documentation.concretecms.org/developers/introduction/version-history/8513-release-notes[WEB]
- https://documentation.concretecms.org/developers/introduction/version-history/922-release-notes[WEB]
- https://github.com/concretecms/concretecms[PACKAGE]
- https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release[WEB]