Aembler

**Name of the Vulnerable Software and Affected Versions** Concrete CMS versions 9 through 9.3.3 Concrete CMS versions below 8.5.19 **Description** The issue is related to stored XSS in the calendar event addition feature. This occurs because the calendar event name was not sanitized on output. Users or groups with permission to create event calendars can embed scripts, and users or groups with permission to modify event calendars can execute scripts. **Recommendations** For Concrete CMS versions 9 through 9.3.3, update to a version above 9.3.3 to resolve the issue. For Concrete CMS versions below 8.5.19, update to version 8.5.19 or higher to resolve the issue. As a temporary workaround, consider restricting access to the calendar event addition feature for users or groups with permission to create or modify event calendars until a patch is available.

Name of the Vulnerable Software and Affected Versions: Concrete CMS versions 9.0.0 through 9.3.3 Concrete CMS versions below 8.5.19 Description: The issue concerns Stored XSS in the Image Editor Background Color, where a rogue admin could add malicious code to the `Thumbnails/Add-Type`. This could potentially lead to security breaches. Recommendations: For Concrete CMS versions 9.0.0 through 9.3.3, update to a version above 9.3.3 to resolve the issue. For Concrete CMS versions below 8.5.19, update to version 8.5.19 or higher to resolve the issue. As a temporary workaround, consider restricting access to the `Thumbnails/Add-Type` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Concrete CMS versions 9.0.0 through 9.3.2 Concrete CMS versions below 8.5.18 **Description** The issue concerns Stored XSS in the RSS Displayer of Concrete CMS, where user input is stored and later embedded into responses. This occurs due to insufficient input validation, allowing a rogue administrator to inject malicious code into fields. **Recommendations** For Concrete CMS versions 9.0.0 through 9.3.2, update to a version above 9.3.2 to resolve the issue. For Concrete CMS versions below 8.5.18, update to version 8.5.18 or higher to resolve the issue. As a temporary workaround, consider restricting access to the RSS Displayer feature until a patch is available. Restrict administrator privileges to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Concrete CMS versions 9 through 9.3.2 Concrete CMS versions below 8.5.18 **Description** The issue concerns a Stored XSS vulnerability in the `getAttributeSetName()` function. A rogue administrator could inject malicious code. **Recommendations** For Concrete CMS versions 9 through 9.3.2, update to a version above 9.3.2 to resolve the issue. For Concrete CMS versions below 8.5.18, update to version 8.5.18 or higher to resolve the issue. As a temporary workaround, consider restricting access to the `getAttributeSetName()` function until a patch is available.