CVE-2024-7398

216.73.217.86

· Published 25/09/2024 01:15 · Modified 30/09/2024 16:12

Labels: CVE-2024-7398 2024-09-25 CVE-2024-7398 CWE-79 ff5b8ace-8b95-4078-9743-eac1ca5451de

Essential information

Published: 25/09/2024 01:15
Modified: 30/09/2024 16:12
Author: —
Creator: —
CVSS: 5.4 MEDIUM (v3.1)
CISA KEV: No
CWE: —
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS metrics

Description

Concrete CMS versions 9 through 9.3.3 and versions below 8.5.19 are vulnerable to stored XSS in the calendar event addition feature because the calendar event name was not sanitized on output. Users or groups with permission to create event calendars can embed scripts, and users or groups with permission to modify event calendars can execute scripts. The Concrete CMS Security Team gave this vulnerability a CVSS v4 score of 1.8 with vector CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N . Thank you, Yusuke Uchida for reporting.

NVD status

Status: Analyzed — CVE has been recently published to the CVE List and has been received by the NVD.
Source: ff5b8ace-8b95-4078-9743-eac1ca5451de
NVD: View on NVD

Affected products (CPE)

Product	CPE
concretecms / concrete cms	`cpe:2.3:a:concretecms:concrete_cms::::::::`
concretecms / concrete cms	`cpe:2.3:a:concretecms:concrete_cms::::::::`