CVE-2024-3180: Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file
Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file. Stored XSS could be caused by a rogue administrator adding malicious code to the link-text field when creating a block of type file. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator . Thanks Alexey Solovyev for reporting.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3180?
CVE-2024-3180 is classified as a high severity vulnerability due to its potential for Stored XSS attacks.
How do I fix CVE-2024-3180?
To fix CVE-2024-3180, upgrade Concrete CMS to version 8.5.16 or 9.2.8 or higher.
Who is affected by CVE-2024-3180?
CVE-2024-3180 affects Concrete CMS versions below 9.2.8 and previous versions below 8.5.16.
What kind of attack can exploit CVE-2024-3180?
CVE-2024-3180 can be exploited through Stored XSS, allowing malicious scripts to be executed in the context of the user.
Is there a workaround for CVE-2024-3180?
There is no official workaround for CVE-2024-3180; the recommended action is to update to a patched version.