CVE-2023-44760: XSS
First published: Mon Oct 23 2023(Updated: )
Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS v.9.2.1 allow an attacker to execute arbitrary code via a crafted script to the Header and Footer Tracking Codes of the SEO & Statistics.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/concrete5/concrete5 | <=9.2.1 | |
| Concretecms Concrete Cms | =9.2.1 | |
| =9.2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/sromanhu/ConcreteCMS-Stored-XSS---TrackingCodes
- https://www.concretecms.org/about/project-news/security/security-advisory-2023-10-31-concrete-cms-rejects-cve-2023-44760-and-cve-2023-44766
- https://github.com/sromanhu/CVE-2023-44760_ConcreteCMS-Stored-XSS---TrackingCodes/issues/1
- https://nvd.nist.gov/vuln/detail/CVE-2023-44760
- https://github.com/advisories/GHSA-4qv6-37xq-mgq2 (Advisory)
Frequently Asked Questions
What is CVE-2023-44760?
CVE-2023-44760 is a vulnerability that allows an attacker to execute arbitrary code through crafted script inputs.
How does the Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 work?
The XSS vulnerability in Concrete CMS v.9.2.1 allows an attacker to inject malicious scripts into the Header and Footer Tracking Codes of the SEO & Statistics, which can be executed by unsuspecting users of the website.
What is the severity of CVE-2023-44760?
CVE-2023-44760 has a severity level of high due to the potential for an attacker to execute arbitrary code.
How can I fix the Cross Site Scripting (XSS) vulnerabilities in Concrete CMS v.9.2.1?
To fix the XSS vulnerabilities in Concrete CMS v.9.2.1, it is recommended to update to a patched version of the software (9.2.2 or later) that resolves the vulnerability.
What is CWE-79?
CWE-79 is a Common Weakness Enumeration category that refers to Cross-Site Scripting (XSS) vulnerabilities.
- collector/mitre-cve
- collector/github-advisory-latest
- alias/GHSA-4qv6-37xq-mgq2
- alias/CVE-2023-44760
- collector/nvd-cve
- collector/github-advisory
- agent/first-publish-date
- agent/type
- agent/author
- agent/severity
- agent/references
- agent/weakness
- agent/description
- agent/softwarecombine
- agent/tags
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/trending
- package-manager/composer
- vendor/concretecms
- canonical/concretecms concrete cms
- version/concretecms concrete cms/9.2.1