Vulnerability · Published Nov 17, 2023 · Assigned by mitre
CVE-2023-48649
Low 3.5
In plain English
A low-severity security flaw in the concrete5/concrete5 package (Packagist). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.6%top 51.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows stored XSS on the Admin page via an uploaded file name.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | concrete5/concrete5 | 8.5.13 | GHSA-36fr-3wg8-q5v8 |
| Packagist | concrete5/concrete5 | 9.2.2 | GHSA-36fr-3wg8-q5v8 |
Affected products (as reported)
References
- https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release
- https://documentation.concretecms.org/developers/introduction/version-history/922-release-notes
- https://documentation.concretecms.org/developers/introduction/version-history/8513-release-notes
- https://github.com/concretecms/concretecms/pull/11695
- https://github.com/concretecms/concretecms/pull/11739