PT-2019-9735 · Concrete5 · Concrete5

Hexife · Published 2019-06-17 · Updated 2021-07-15 · CVE-2018-19146

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Concrete5 version 8.4.3

Description The issue allows for XSS attacks because the config/concrete.php file permits administrators to upload SVG files that may contain HTML data with a SCRIPT element.

Recommendations For Concrete5 version 8.4.3, consider restricting the upload of SVG files or ensure that all uploaded files are thoroughly validated to prevent the inclusion of malicious HTML data, such as SCRIPT elements, until a proper fix is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-19146

Affected Products

Concrete5

References · 7

• 🔥 https://hackerone.com/reports/437863 · Exploit
• https://osv.dev/vulnerability/CVE-2018-19146 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19146 · Security Note
• https://concrete5.org · Vendor Advisory
• https://t.me/cvenotify/17702 · Telegram Post
• https://hackerone.com/concrete5?view_policy=true · Note
• https://w3.org/TR/SVG2/intro.html#W3CCompatibility · Note