Stored XSS in Folder Function by Rogue Admin
Résumé
Stored XSS in Folder Function by Rogue Admin
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Concrete CMS versions 9.0.0 through 9.3.9 are affected by a stored XSS in Folder Function.The "Add Folder" functionality lacks input sanitization, allowing a rogue admin to inject XSS payloads as folder names. The Concrete CMS security team gave this vulnerability a CVSS 4.0 Score of 4.8 with vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N. Versions below 9 are not affected. Thanks, Alfin Joseph for reporting.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory documentation.concretecms.org
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- patch github.com
- patch github.com