CVE-2024-3178: Concrete CMS versions 9 below 9.2.8 and versions below 8.5.16 are vulnerable to Cross-site Scripting (XSS) in the Advanced File Search Filter. Prior to the…

PriorityP421medium4.8CVSS 3.1

AVNACLPRHUIRSCCLILAN

EPSS

0.36%

27.8th percentile

Concrete CMS versions 9 below 9.2.8 and versions below 8.5.16 are vulnerable to Cross-site Scripting (XSS) in the Advanced File Search Filter. Prior to the fix, a rogue administrator could add malicious code in the file manager because of insufficient validation of administrator provided data. All administrators have access to the File Manager and hence could create a search filter with the malicious code attached. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator .

Affected

6 ranges

Vendor	Product	Version range	Fixed in
concrete5	concrete5	>= 0 < 8.5.16	8.5.16
concrete5	concrete5	>= 9.0.0RC1 < 9.2.8	9.2.8
concrete_cms	concrete_cms	>= 5.0.0 < 8.5.16	8.5.16
concrete_cms	concrete_cms	>= 9.0.0 < 9.2.8	9.2.8
concretecms	concrete_cms	< 8.5.16	8.5.16
concretecms	concrete_cms	>= 9.0.0 < 9.2.8	9.2.8

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.