PT-2024-17609 · Unknown · Concrete Cms

Cupc4K3 · Published 2024-02-09 · Updated 2025-01-15 · CVE-2024-1247

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.0.0 through 9.2.4

Description The issue is related to stored XSS via the Role Name field due to insufficient validation of administrator-provided data. A rogue administrator could inject malicious code into the Role Name field, which might be executed when users visit the affected page.

Recommendations For Concrete CMS versions 9.0.0 through 9.2.4, update to version 9.2.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the Role Name field to minimize the risk of exploitation.

Fix

XSS

RCE

Weakness Enumeration

CWE-79

CWE-20

Related Identifiers

CVE-2024-1247

GHSA-Q25H-JCH8-GFRP

Affected Products

Concrete Cms

References · 11

• https://concretecms.org/about/project-news/security/2024-02-04-security-advisory · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q25h-jch8-gfrp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1247 · Security Note
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/925-release-notes · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-1247 · Vendor Advisory
• https://github.com/concretecms/concretecms · Note
• https://github.com/concretecms/concretecms/commit/59a07472ad6349a2c5fb455837a54ed1fe3f6953 · Note
• https://twitter.com/CVEnew/status/1756033602209341668 · Twitter Post
• https://t.me/cvenotify/70995 · Telegram Post
• https://twitter.com/Nxploited/status/1879501478353604706 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1756078341591875688 · Twitter Post