PT-2019-9735 · Concrete5 · Concrete5

Hexife · Publicado 2019-06-17 · Atualizado 2021-07-15 · CVE-2018-19146

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Concrete5 version 8.4.3

Description The issue allows for XSS attacks because the config/concrete.php file permits administrators to upload SVG files that may contain HTML data with a SCRIPT element.

Recommendations For Concrete5 version 8.4.3, consider restricting the upload of SVG files or ensure that all uploaded files are thoroughly validated to prevent the inclusion of malicious HTML data, such as SCRIPT elements, until a proper fix is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-19146

Produtos afetados

Concrete5

Referências · 7

• 🔥 https://hackerone.com/reports/437863 · Exploit
• https://osv.dev/vulnerability/CVE-2018-19146 · Aviso do Fabricante
• https://t.me/cvenotify/17702 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2018-19146 · Nota de Segurança
• https://hackerone.com/concrete5?view_policy=true · Nota
• https://w3.org/TR/SVG2/intro.html#W3CCompatibility · Nota
• https://concrete5.org · Aviso do Fabricante