CVE-2021-40100: XSS
Published Sep 24, 2021
·Updated
An issue was discovered in Concrete CMS through 8.5.5. Stored XSS can occur in Conversations when the Active Conversation Editor is set to Rich Text.
Affected Software
1 affected component
ConcreteCMS Concrete CMS<=8.5.5
Event History
Sep 24, 2021
CVE Published
via MITRE·02:57 PM
Data Sourced
via MITRE·02:57 PM
Description
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2021-40100?
The severity of CVE-2021-40100 is considered medium due to the potential impact of stored XSS.
2
How do I fix CVE-2021-40100?
To fix CVE-2021-40100, upgrade Concrete CMS to version 8.5.6 or later.
3
What causes the vulnerability in CVE-2021-40100?
CVE-2021-40100 is caused by improper validation of user input in the Active Conversation Editor when set to Rich Text.
4
What are the potential impacts of CVE-2021-40100?
The potential impacts of CVE-2021-40100 include unauthorized script execution and potential account compromise.
5
Who is affected by CVE-2021-40100?
CVE-2021-40100 affects users of Concrete CMS versions up to and including 8.5.5.