// For flags

CVE-2024-2179

Concrete CMS version 9 before 9.2.7 is vulnerable to Stored XSS via the Name field of a Group type

Severity Score

2.2
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

Concrete CMS version 9 before 9.2.7 is vulnerable to Stored XSS via the Name field of a Group type since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Name field which might be executed when users visit the affected page. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 2.2 with a vector of AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N Concrete versions below 9 do not include group types so they are not affected by this vulnerability. Thanks Luca Fuda for reporting.

La versión 9 de Concrete CMS anterior a la 9.2.7 es vulnerable a XSS almacenado a través del campo Nombre de un tipo de grupo, ya que no hay validación suficiente de los datos proporcionados por el administrador para ese campo. Un administrador deshonesto podría inyectar código malicioso en el campo Nombre que podría ejecutarse cuando los usuarios visitan la página afectada. El equipo de seguridad de Concrete CMS le dio a esta vulnerabilidad una puntuación CVSS v3.1 de 2.2 con un vector de AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A: N Las versiones concretas inferiores a 9 no incluyen tipos de grupos, por lo que no se ven afectados por esta vulnerabilidad. Gracias a Luca Fuda por informar.

*Credits: Luca Fuda
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-03-04 CVE Reserved
  • 2024-03-05 CVE Published
  • 2024-03-06 EPSS Updated
  • 2024-05-09 First Exploit
  • 2024-08-30 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-20: Improper Input Validation
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
  • CAPEC-592: Stored XSS
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Concrete CMS
Search vendor "Concrete CMS"
 Concrete CMS
Search vendor "Concrete CMS" for product "Concrete CMS"
 >= 9.0.0 < 9.2.7
Search vendor "Concrete CMS" for product "Concrete CMS" and version " >= 9.0.0 < 9.2.7"
en
Affected