cbcvebase.
CVE-2024-2753
published 2024-04-03

CVE-2024-2753: Concrete CMS version 9 before 9.2.8 and previous versions prior to 8.5.16 is vulnerable to Stored XSS on the calendar color settings screen since Information…

PriorityP420medium4.8CVSS 3.1
AVNACLPRHUIRSCCLILAN
EPSS
0.36%
28.1th percentile
Concrete CMS version 9 before 9.2.8 and previous versions prior to 8.5.16 is vulnerable to Stored XSS on the calendar color settings screen since Information input by the user is output without escaping. A rogue administrator could inject malicious javascript into the Calendar Color Settings screen which might be executed when users visit the affected page. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 2.0 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N&version=3.1 https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator Thank you Rikuto Tauchi for reporting

Affected

6 ranges
VendorProductVersion rangeFixed in
concrete5concrete5>= 0 < 8.5.168.5.16
concrete5concrete5>= 9.0.0RC1 < 9.2.89.2.8
concrete_cmsconcrete_cms>= 5.0.0 < 8.5.168.5.16
concrete_cmsconcrete_cms>= 9.0.0 < 9.2.89.2.8
concretecmsconcrete_cms< 8.5.168.5.16
concretecmsconcrete_cms>= 9.0.0 < 9.2.89.2.8

CVSS provenance

nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.