CVE-2023-28819
Concrete CMS (previously concrete5) versions 8.5.12 and below, 9.0.0 through 9.0.2 is vulnerable to Stored XSS in uploaded file and folder names.
Summary
Concrete CMS (previously concrete5) is vulnerable to stored XSS in uploaded file and folder names
Original description
The description as published by the source.
Concrete CMS (previously concrete5) versions 8.5.12 and below, 9.0.0 through 9.0.2 is vulnerable to Stored XSS in uploaded file and folder names.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Packagist
concrete5/concrete5
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0"}]}]
References
- advisory nvd.nist.gov
- advisory concretecms.org
- advisory github.com
- package github.com
- web github.com
- web github.com
- web concretecms.org