GHSA-474f-mcjv-pgrmLowCVSS 3.5
Concrete CMS (previously concrete5) is vulnerable to stored XSS in uploaded file and folder names
🔗 CVE IDs covered (1)
📋 Description
Concrete CMS (previously concrete5) before 9.1 is vulnerable to Stored XSS in uploaded file and folder names.
🎯 Affected products1
- composer/concrete5/concrete5:< 9.1.0
🔗 References (7)
- https://nvd.nist.gov/vuln/detail/CVE-2023-28819
- https://github.com/concretecms/concretecms/releases
- https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20
- https://github.com/concretecms/concretecms/pull/11749
- https://github.com/concretecms/concretecms/releases/tag/8.5.13
- https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release
- https://github.com/advisories/GHSA-474f-mcjv-pgrm