PT-2023-29285 · Unknown · Concrete Cms

Romanhu · Published 2023-10-06 · Updated 2023-12-07 · CVE-2023-44761

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 8.5.13 and below Concrete CMS versions 9.0.0 through 9.2.1

Description Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS allow a local attacker to execute arbitrary code via a crafted script to the Forms of the Data objects.

Recommendations For Concrete CMS versions 8.5.13 and below, update to a version above 8.5.13. For Concrete CMS versions 9.0.0 through 9.2.1, update to a version above 9.2.1. As a temporary workaround, consider disabling the Forms of the Data objects until a patch is available. Restrict access to the Data objects to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-44761

GHSA-P4JJ-GWPG-9JWH

Affected Products

Concrete Cms

References · 10

• 🔥 https://github.com/sromanhu/ConcreteCMS-Stored-XSS---Forms · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-44761 · Security Note
• https://osv.dev/vulnerability/CVE-2023-44761 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p4jj-gwpg-9jwh · Vendor Advisory
• https://github.com/concretecms/concretecms · Note
• https://t.me/cibsecurity/71714 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1710308782817874297 · Twitter Post
• https://concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release · Note
• https://twitter.com/CVEnew/status/1710277637724332124 · Twitter Post
• https://t.me/cvenotify/62680 · Telegram Post