PT-2024-21936 · Unknown · Concrete Cms

Rikuto Tauchi

·

Published

2024-04-03

·

Updated

2024-12-16

·

CVE-2024-2753

CVSS v3.1

4.8

Medium

VectorAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.0.0 through 9.2.7 Concrete CMS versions prior to 8.5.16
Description The issue concerns a Stored XSS vulnerability on the calendar color settings screen. This occurs because user input is output without proper escaping, allowing a rogue administrator to inject malicious JavaScript into the Calendar Color Settings screen. This malicious code might be executed when users visit the affected page.
Recommendations For Concrete CMS versions 9.0.0 through 9.2.7, update to version 9.2.8 or later. For Concrete CMS versions prior to 8.5.16, update to version 8.5.16 or later. As a temporary workaround, consider restricting access to the calendar color settings screen to minimize the risk of exploitation.

Fix

XSS

RCE

Weakness Enumeration

CWE-79CWE-20

Related Identifiers

CVE-2024-2753
GHSA-PJ42-R64F-4XFQ

Affected Products

Concrete Cms