PT-2024-17599 · Unknown · Concrete Cms

Poto Gabor · Published 2024-02-09 · Updated 2024-02-15 · CVE-2024-1245

Positive Technologies (AI Summary)

CVSS v3.1

2.4

Low

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Concrete CMS version 9 before 9.2.5

Description The issue concerns stored XSS in file tags and description attributes. Administrator-entered file attributes are not sufficiently sanitized in the Edit Attributes page, allowing a rogue administrator to put malicious code into the file tags or description attributes. This malicious code could execute when another administrator opens the same file for editing.

Recommendations For Concrete CMS version 9 before 9.2.5, update to version 9.2.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the Edit Attributes page to minimize the risk of exploitation. Additionally, avoid using unsanitized input from administrator-entered file attributes in the file tags or description attributes until the issue is resolved.

Fix

XSS

RCE

Weakness Enumeration

CWE-79

CWE-20

Related Identifiers

CVE-2024-1245

GHSA-MGP6-J658-VCW9

Affected Products

Concrete Cms

References · 11

• https://osv.dev/vulnerability/CVE-2024-1245 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1245 · Security Note
• https://concretecms.org/about/project-news/security/2024-02-04-security-advisory · Vendor Advisory
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/925-release-notes · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mgp6-j658-vcw9 · Vendor Advisory
• https://github.com/concretecms/concretecms · Note
• https://github.com/concretecms/concretecms/commit/59a07472ad6349a2c5fb455837a54ed1fe3f6953 · Note
• https://twitter.com/CVEnew/status/1756043431107813381 · Twitter Post
• https://t.me/cvenotify/70885 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1756077835603599743 · Twitter Post
• https://t.me/cvenotify/70996 · Telegram Post