CVE-2024-3179
Assigner: ConcreteCMS
Published: 2024-04-03T18:50:45.711Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Concrete CMS
repo: https://github.com/concretecms/concretecms
vendor: Concrete CMS
versions: lessThan: 9.2.8
status: affected
version: 9.0.0
versionType: git
lessThan: 8.5.16
status: affected
version: 5.0.0
versionType: git
credits: type: finder
value: Alexey Solovyev
datePublic: 2024-04-03T18:40:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: Concrete CMS version 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to&nbsp;Stored XSS in the Custom Class page editing.&nbsp;Prior to the fix, a rogue administrator could insert malicious code in the custom class field due to insufficient validation of administrator provided data.&nbsp;<span style="background-color: rgb(255, 255, 255);">The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of </span><a target="_blank" rel="nofollow" href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L&amp;version=3.1"><span style="background-color: rgb(255, 255, 255);">AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L</span></a><span style="background-color: transparent;">. Thanks&nbsp;Alexey Solovyev for reporting.&nbsp;</span><br><br><br>
value: Concrete CMS version 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to Stored XSS in the Custom Class page editing. Prior to the fix, a rogue administrator could insert malicious code in the custom class field due to insufficient validation of administrator provided data. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of  AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator . Thanks Alexey Solovyev for reporting. 


impacts: capecId: CAPEC-592
descriptions: value: CAPEC-592 Stored XSS
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-20
description: CWE-20 Improper Input Validation
type: CWE
source: advisory: https://hackerone.com/reports/918129
discovery: EXTERNAL
title: Concrete CMS version 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to Stored XSS in the Custom Class page
x_generator: engine: Vulnogram 0.1.0-dev