PT-2023-21987 · Unknown · Concrete Cms

Solov9Ev · CVE-2023-28819 · Published 2023-04-28 · Updated 2023-12-06

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Concrete CMS (previously concrete5) versions 8.5.12 and below Concrete CMS (previously concrete5) versions 9.0.0 through 9.0.2

Description The issue is related to Stored XSS in uploaded file and folder names.

Recommendations For Concrete CMS (previously concrete5) versions 8.5.12 and below, update to version 9.1 or later. For Concrete CMS (previously concrete5) versions 9.0.0 through 9.0.2, update to version 9.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-28819

GHSA-474F-MCJV-PGRM

Affected Products

Concrete Cms

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28819.json · Exploit
• https://osv.dev/vulnerability/GHSA-474f-mcjv-pgrm · Vendor Advisory
• https://concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28819 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28819 · Vendor Advisory
• https://github.com/concretecms/concretecms/releases · Note
• https://github.com/concretecms/concretecms/pull/11749 · Note
• https://github.com/concretecms/concretecms/releases/tag/8.5.13 · Note
• https://t.me/cvenotify/62482 · Telegram Post
• https://concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release · Note
• https://t.me/cibsecurity/63068 · Telegram Post