PT-2024-30594 · Unknown · Concrete Cms

Aembler + 1 · Published 2024-08-09 · Updated 2025-01-17 · CVE-2024-4350

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.0.0 through 9.3.2 Concrete CMS versions below 8.5.18

Description The issue concerns Stored XSS in the RSS Displayer of Concrete CMS, where user input is stored and later embedded into responses. This occurs due to insufficient input validation, allowing a rogue administrator to inject malicious code into fields.

Recommendations For Concrete CMS versions 9.0.0 through 9.3.2, update to a version above 9.3.2 to resolve the issue. For Concrete CMS versions below 8.5.18, update to version 8.5.18 or higher to resolve the issue. As a temporary workaround, consider restricting access to the RSS Displayer feature until a patch is available. Restrict administrator privileges to minimize the risk of exploitation.

Fix

XSS

RCE

Weakness Enumeration

CWE-79

CWE-20

Related Identifiers

CVE-2024-4350

GHSA-Q5WX-M95R-4CGC

Affected Products

Concrete Cms

References · 10

• https://github.com/concretecms/concretecms/commit/c08d9671cec4e7afdabb547339c4bc0bed8eab06 · Patch
• https://github.com/concretecms/concretecms/pull/12166 · Patch
• https://documentation.concretecms.org/developers/introduction/version-history/8518-release-notes?pk_vid=e367a434ef4830491723055758d52041 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4350 · Security Note
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/933-release-notes?pk_vid=e367a434ef4830491723060415d52041 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q5wx-m95r-4cgc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-4350 · Vendor Advisory
• https://github.com/concretecms/concretecms · Note
• https://github.com/concretecms/concretecms/commit/55e485e06b0b3342613a55af6a7c61d939d2ccb5 · Note
• https://t.me/cvenotify/91196 · Telegram Post