CVE-2026-3242
Concrete CMS below 9.4.8 is vulnerable to Stored XSS in the Switch Language block
概要
Concrete CMS below 9.4.8 is vulnerable to Stored XSS in the Switch Language block
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
In Concrete CMS below version 9.4.8, a rogue administrator can add stored XSS via the Switch Language block. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks M3dium for reporting.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- patch github.com
- web documentation.concretecms.org