PT-2023-21987 · Unknown · Concrete Cms

Solov9Ev · Published 2023-04-28 · Updated 2023-12-06 · CVE-2023-28819

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Concrete CMS (previously concrete5) versions 8.5.12 and below Concrete CMS (previously concrete5) versions 9.0.0 through 9.0.2

Description The issue is related to Stored XSS in uploaded file and folder names.

Recommendations For Concrete CMS (previously concrete5) versions 8.5.12 and below, update to version 9.1 or later. For Concrete CMS (previously concrete5) versions 9.0.0 through 9.0.2, update to version 9.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-28819

GHSA-474F-MCJV-PGRM

Affected Products

Concrete Cms

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2023-28819 · Security Note
• https://concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-474f-mcjv-pgrm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28819 · Vendor Advisory
• https://github.com/concretecms/concretecms/releases · Note
• https://github.com/concretecms/concretecms/pull/11749 · Note
• https://github.com/concretecms/concretecms/releases/tag/8.5.13 · Note
• https://t.me/cvenotify/62482 · Telegram Post
• https://t.me/cibsecurity/63068 · Telegram Post
• https://concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release · Note