CVE-2023-44766: XSS
First published: Fri Oct 06 2023(Updated: )
A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from Page Settings.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Concretecms Concrete Cms | =9.2.1 | |
| composer/concrete5/concrete5 | <=9.2.1 | |
| =9.2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/sromanhu/ConcreteCMS-Stored-XSS---SEO
- https://www.concretecms.org/about/project-news/security/security-advisory-2023-10-31-concrete-cms-rejects-cve-2023-44760-and-cve-2023-44766
- https://nvd.nist.gov/vuln/detail/CVE-2023-44766
- https://github.com/advisories/GHSA-437p-jfm4-2387 (Advisory)
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-44766.
What is the severity of CVE-2023-44766?
The severity of CVE-2023-44766 is medium with a CVSS score of 5.4.
How does the Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 impact the system?
The XSS vulnerability allows an attacker to execute arbitrary code by injecting a crafted script to the SEO - Extra from Page Settings.
Which versions of Concrete CMS are affected by CVE-2023-44766?
Concrete CMS v.9.2.1 is affected by CVE-2023-44766.
How can I fix the Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1?
To fix the XSS vulnerability, update Concrete CMS to a version that has a patch for the vulnerability.
- collector/nvd-index
- collector/mitre-cve
- collector/github-advisory-latest
- alias/GHSA-437p-jfm4-2387
- alias/CVE-2023-44766
- collector/nvd-cve
- collector/github-advisory
- agent/type
- agent/references
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/author
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/concretecms
- canonical/concretecms concrete cms
- version/concretecms concrete cms/9.2.1
- package-manager/composer