low3.5
CVE-2023-28819
Concrete CMS (previously concrete5) is vulnerable to stored XSS in uploaded file and folder names
Impact
Concrete CMS (previously concrete5) before 9.1 is vulnerable to Stored XSS in uploaded file and folder names.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | concrete5/concrete5 | < 9.1.0 | 9.1.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Concretecms | Concrete Cms | before 9.1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/concretecms/concretecms/releases
- https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release
- https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20
- https://github.com/advisories/GHSA-474f-mcjv-pgrm
- https://nvd.nist.gov/vuln/detail/CVE-2023-28819
- https://github.com/concretecms/concretecms/pull/11749
- https://github.com/concretecms/concretecms/releases/tag/8.5.13