PT-2023-29285 · Unknown · Concrete Cms

Romanhu · CVE-2023-44761 · Publicado 2023-10-06 · Atualizado 2023-12-07

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 8.5.13 and below Concrete CMS versions 9.0.0 through 9.2.1

Description Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS allow a local attacker to execute arbitrary code via a crafted script to the Forms of the Data objects.

Recommendations For Concrete CMS versions 8.5.13 and below, update to a version above 8.5.13. For Concrete CMS versions 9.0.0 through 9.2.1, update to a version above 9.2.1. As a temporary workaround, consider disabling the Forms of the Data objects until a patch is available. Restrict access to the Data objects to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-44761

GHSA-P4JJ-GWPG-9JWH

Produtos afetados

Concrete Cms

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/44xxx/CVE-2023-44761.json · Exploit
• 🔥 https://github.com/sromanhu/ConcreteCMS-Stored-XSS---Forms · Exploit
• https://github.com/concretecms/concretecms · Nota
• https://osv.dev/vulnerability/GHSA-p4jj-gwpg-9jwh · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1710277637724332124 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-44761 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-44761 · Nota de Segurança
• https://concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release · Nota
• https://t.me/cvenotify/62680 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1710308782817874297 · Publicação no Twitter
• https://t.me/cibsecurity/71714 · Publicação no Telegram