PT-2024-39158 · Unknown · Concrete Cms

Published 2024-09-17 · Updated 2024-09-23 · CVE-2024-8660

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Concrete CMS versions 9.0.0 through 9.3.3

Description: The issue is related to a stored XSS vulnerability in the "Top Navigator Bar" block. Since the "Top Navigator Bar" output was not sufficiently sanitized, a rogue administrator could add a malicious payload that could be executed when targeted users visited the home page.

Recommendations: For Concrete CMS versions 9.0.0 through 9.3.3, upgrade to a version that includes the fix for this vulnerability. As a temporary workaround, consider disabling the "Top Navigator Bar" block until a patch is available. Restrict access to the "Top Navigator Bar" block to minimize the risk of exploitation. Avoid using the "Top Navigator Bar" block in sensitive areas of the application until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-8660

GHSA-998C-Q8HH-H8GV

Affected Products

Concrete Cms

References · 11

• https://github.com/concretecms/concretecms/pull/12128 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-8660 · Security Note
• https://osv.dev/vulnerability/GHSA-998c-q8hh-h8gv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-8660 · Vendor Advisory
• https://github.com/concretecms/concretecms · Note
• https://github.com/concretecms/concretecms/commit/f5a01c88fb2630db96e58dcd7f52ea41e516d4e9 · Note
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/934-release-notes · Note
• https://t.me/cvenotify/95768 · Telegram Post
• https://twitter.com/oktsec/status/1836157594290749628 · Twitter Post
• https://t.me/cvedetector/5842 · Telegram Post
• https://twitter.com/CVEnew/status/1836113874522902695 · Twitter Post