MEDIUM5.4

GHSA-4qv6-37xq-mgq2

Concrete CMS Cross-site Scripting vulnerability

Details

Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS v.9.2.1 allow an attacker to execute arbitrary code via a crafted script to the Header and Footer Tracking Codes of the SEO & Statistics.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/concrete5/concrete5

Introduced in: 0

No fixed version published yet for concrete5/concrete5 (composer). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-44760[ADVISORY]
https://github.com/sromanhu/CVE-2023-44760_ConcreteCMS-Stored-XSS---TrackingCodes/issues/1[WEB]
https://github.com/concretecms/concretecms[PACKAGE]
https://github.com/sromanhu/ConcreteCMS-Stored-XSS---TrackingCodes[WEB]
https://www.concretecms.org/about/project-news/security/security-advisory-2023-10-31-concrete-cms-rejects-cve-2023-44760-and-cve-2023-44766[WEB]