CVE-2023-44763: XSS
Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting (XSS). NOTE: the vendor's position is that a customer is supposed to know that "pdf" should be excluded from the allowed file types, even though pdf is one of the allowed file types in the default configuration.
Other sources
Concrete CMS v9.2.1 is affected by Arbitrary File Upload vulnerability via the Thumbnail file upload, which allows Cross-Site Scripting (XSS).
Concrete CMS v9.2.1 is affected by Arbitrary File Upload vulnerability via the Thumbnail" file upload, which allows Cross-Site Scripting (XSS).
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-44763.
What is the severity of CVE-2023-44763?
The severity of CVE-2023-44763 is medium with a CVSS score of 5.4.
What is the affected software?
The affected software is Concrete CMS version 9.2.1.
How does CVE-2023-44763 work?
CVE-2023-44763 allows arbitrary file uploads via the Thumbnail file upload, which can lead to Cross-Site Scripting (XSS) attacks.
Is there a fix available for CVE-2023-44763?
At the time of writing, there is no known fix or patch available for CVE-2023-44763. It is recommended to follow security best practices and monitor for updates from the software vendor.