CVE-2024-4350: Concrete CMS version 9 below 9.3.3 and below 8.5.18 are vulnerable to Stored XSS in RSS Displayer
Published Aug 9, 2024
·Updated
Concrete CMS versions 9.0.0 to 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in RSS Displayer when user input is stored and later embedded into responses. A rogue administrator could inject malicious code into fields due to insufficient input validation.
Affected Software
4 affected componentsFixes available
composer/concrete5/concrete5>=9.0.0RC1<9.3.3
9.3.3
composer/concrete5/concrete5<8.5.18
8.5.18
ConcreteCMS Concrete CMS<8.5.18
ConcreteCMS Concrete CMS>=9.0.0<9.3.3
Remediation
Patch Available
Event History
Aug 9, 2024
CVE Published
via MITRE·12:37 AM
Data Sourced
via MITRE·12:37 AM
DescriptionWeakness
Aug 12, 2024
Data Sourced
via NVD·01:38 PM
RemedyDescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·03:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-4350?
CVE-2024-4350 has a high severity rating due to the potential for stored XSS attacks.
2
How do I fix CVE-2024-4350?
To fix CVE-2024-4350, upgrade Concrete CMS to version 9.3.3 or 8.5.18.
3
What versions are affected by CVE-2024-4350?
CVE-2024-4350 affects Concrete CMS versions 9.0.0 to 9.3.2 and all versions below 8.5.18.
4
Can an unprivileged user exploit CVE-2024-4350?
Yes, an unprivileged user could exploit CVE-2024-4350 if an administrator inadvertently allows input injection.
5
What type of vulnerability is CVE-2024-4350?
CVE-2024-4350 is classified as a stored cross-site scripting (XSS) vulnerability.