CVE-2023-28819
Concrete CMS (previously concrete5) versions 8.5.12 and below, 9.0.0 through 9.0.2 is vulnerable to Stored XSS in uploaded file and folder names.
Résumé
Concrete CMS (previously concrete5) is vulnerable to stored XSS in uploaded file and folder names
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Concrete CMS (previously concrete5) versions 8.5.12 and below, 9.0.0 through 9.0.2 is vulnerable to Stored XSS in uploaded file and folder names.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Packagist
concrete5/concrete5
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0"}]}]
Références
- advisory nvd.nist.gov
- advisory concretecms.org
- advisory github.com
- package github.com
- web github.com
- web github.com
- web concretecms.org