CVE-2023-28477 - Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to stored XSS on API Integrations via the name parameter

Back Back to CVE browser

MEDIUM

Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to stored XSS on API Integrations via the name parameter

Published Apr 28, 2023

5.5

MEDIUM

CVSS 3.1

EPSS 0.58%

Description

Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to stored XSS on API Integrations via the name parameter.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (7)

Link	Providers	Tags
https://concretecms.com		Product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-1425		Advisory
https://github.com/advisories/GHSA-xfmj-r86m-j2hr		Advisory
https://github.com/concretecms/concretecms/commit/546cef6ec29208d5c079113635cd6e6b250e9f7c
https://nvd.nist.gov/vuln/detail/CVE-2023-28477
https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release
https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20		Vendor Advisory