CVE-2024-1246

Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature due to insufficient validation of administrator provided data. A rogue administrator could inject malicious code when importing images, leading to the execution of the malicious code on the website user’s browser. The Concrete CMS Security team scored this 2 with CVSS v3 vector AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N. This does not affect Concrete versions prior to version 9.
Configurations

Configuration 1 (hide)

cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:50

Type Values Removed Values Added
References () https://documentation.concretecms.org/9-x/developers/introduction/version-history/925-release-notes - Release Notes, Vendor Advisory () https://documentation.concretecms.org/9-x/developers/introduction/version-history/925-release-notes - Release Notes, Vendor Advisory
References () https://www.concretecms.org/about/project-news/security/2024-02-04-security-advisory - Vendor Advisory () https://www.concretecms.org/about/project-news/security/2024-02-04-security-advisory - Vendor Advisory
CVSS v2 : unknown
v3 : 4.8
v2 : unknown
v3 : 2.0

15 Feb 2024, 04:44

Type Values Removed Values Added
References () https://documentation.concretecms.org/9-x/developers/introduction/version-history/925-release-notes - () https://documentation.concretecms.org/9-x/developers/introduction/version-history/925-release-notes - Release Notes, Vendor Advisory
References () https://www.concretecms.org/about/project-news/security/2024-02-04-security-advisory - () https://www.concretecms.org/about/project-news/security/2024-02-04-security-advisory - Vendor Advisory
Summary
  • (es) Concrete CMS en la versión 9 anterior a la 9.2.5 es vulnerable al XSS reflejado a través de la función de importación de URL de imagen debido a una validación insuficiente de los datos proporcionados por el administrador. Un administrador deshonesto podría inyectar código malicioso al importar imágenes, lo que provocaría la ejecución del código malicioso en el navegador del usuario del sitio web. El equipo de seguridad de Concrete CMS obtuvo este 2 con el vector CVSS v3 AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N. Esto no afecta a las versiones de Concrete anteriores a la versión 9.
CPE cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : 2.0
v2 : unknown
v3 : 4.8
First Time Concretecms
Concretecms concrete Cms
CWE CWE-79

09 Feb 2024, 22:15

Type Values Removed Values Added
Summary (en) Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature due to insufficient validation of administrator provided data. A rogue administrator could inject malicious code when importing images, leading to the execution of the malicious code on the website user’s browser. The Concrete CMS Security team scored this 2 with CVSS v3 vector AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator . This does not affect Concrete versions prior to version 9. (en) Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature due to insufficient validation of administrator provided data. A rogue administrator could inject malicious code when importing images, leading to the execution of the malicious code on the website user’s browser. The Concrete CMS Security team scored this 2 with CVSS v3 vector AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N. This does not affect Concrete versions prior to version 9.

09 Feb 2024, 20:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-02-09 20:15

Updated : 2024-11-21 08:50


NVD link : CVE-2024-1246

Mitre link : CVE-2024-1246

CVE.ORG link : CVE-2024-1246


JSON object : View

Products Affected

concretecms

  • concrete_cms
CWE
CWE-20

Improper Input Validation

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')