CVSS4
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
ACTIVE
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:L/SC:N/VI:N/SI:N/VA:N/SA:N
AI Score
Confidence
High
EPSS
Percentile
14.7%
SSVC
Exploitation
none
Automatable
no
Technical Impact
partial
Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in Board instances. A rogue administrator could inject malicious code. The Concrete CMS security team gave this vulnerability a CVSS 4.0 Score of 1.8 with vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Versions below 9 are not affected. Thanks, m3dium for reporting.
[
{
"repo": "https://github.com/concretecms/concretecms",
"vendor": "Concrete CMS",
"product": "Concrete CMS",
"versions": [
{
"status": "affected",
"version": "9.0.0",
"versionType": "git",
"lessThanOrEqual": "9.3.2"
}
],
"defaultStatus": "unaffected"
}
]
CVSS4
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
ACTIVE
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:L/SC:N/VI:N/SI:N/VA:N/SA:N
AI Score
Confidence
High
EPSS
Percentile
14.7%
SSVC
Exploitation
none
Automatable
no
Technical Impact
partial