LOW2.0

GHSA-fgxj-g7x3-85cq

Stored cross site scripting in RSS displayer

Quick fix

GHSA-fgxj-g7x3-85cq — concrete5/concrete5: upgrade to the fixed version with the command below.

composer require concrete5/concrete5:^9.1.0

Details

Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was not sanitized.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/concrete5/concrete5

Introduced in: 0Fixed in: 9.1.0

Fixcomposer require concrete5/concrete5:^9.1.0

References

https://nvd.nist.gov/vuln/detail/CVE-2023-28820[ADVISORY]
https://github.com/concretecms/concretecms[PACKAGE]
https://github.com/concretecms/concretecms/releases[WEB]
https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20[WEB]