Cross-site Scripting (XSS)

2024-04-0408:10:04

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site scripting

concrete cms

vulnerability

calendar

color settings

javascript

user input

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

AI Score

6.5

Confidence

High

EPSS

Percentile

9.0%

JSON

Concrete CMS is vulnerable to Cross-site Scripting (XSS). The vulnerability is due to user input not being properly escaped, allowing a rogue administrator to inject malicious JavaScript into the Calendar Color Settings screen, which may then be executed when users visit the affected page.

References

documentation.concretecms.org/9-x/developers/introduction/version-history/928-release-notes?_gl=1*1bcxp5s*_ga*MTc1NDc0Njk2Mi4xNzA2ODI4MDU1*_ga_HFB3HPNNLS*MTcxMjE2NjYyNi4xMy4xLjE3MTIxNjY2ODEuMC4wLjA.

documentation.concretecms.org/developers/introduction/version-history/8516-release-notes?_gl=1*1oa3zn1*_ga*MTc1NDc0Njk2Mi4xNzA2ODI4MDU1*_ga_HFB3HPNNLS*MTcxMjE2NjYyNi4xMy4xLjE3MTIxNjY3MDcuMC4wLjA.

github.com/advisories/GHSA-pj42-r64f-4xfq

github.com/concretecms/concretecms/commit/822e689cefe1eb876e9de31dad9ce660f3b5c295

github.com/concretecms/concretecms/commit/e85ef2408a5eea7d5646178fbef0ab243baaed8f