PT-2023-30871 · Unknown · Concrete Cms

Silvereniqmain + 2 · Publicado 2023-12-25 · Atualizado 2024-12-16 · CVE-2023-48650

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 8.5.13 and earlier Concrete CMS versions 9.0.0 through 9.2.2

Description The issue allows an admin to add a stored XSS payload via the Layout Preset name, potentially affecting user interactions with the system.

Recommendations For Concrete CMS versions 8.5.13 and earlier, update to version 8.5.14 or later. For Concrete CMS versions 9.0.0 through 9.2.2, update to version 9.2.3 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-48650

GHSA-X577-GCC9-9XJJ

Produtos afetados

Concrete Cms

Referências · 9

• https://github.com/concretecms/concretecms · Nota
• https://github.com/concretecms/concretecms/commit/5b93470bcccf271810d3a0b190368ce6a9d6c84b · Nota
• https://github.com/concretecms/concretecms/commit/077755e6bbbc1c67b7508add9e3d207e8d8909a0 · Nota
• https://osv.dev/vulnerability/GHSA-x577-gcc9-9xjj · Aviso do Fabricante
• https://concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-48650 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1739363664300302587 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-48650 · Nota de Segurança
• https://documentation.concretecms.org/developers/introduction/version-history/923-release-notes · Nota