- Description
- Concrete CMS version 9 before 9.2.8 and previous versions prior to 8.5.16 is vulnerable to Stored XSS on the calendar color settings screen since Information input by the user is output without escaping. A rogue administrator could inject malicious javascript into the Calendar Color Settings screen which might be executed when users visit the affected page. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 2.0 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N&version=3.1 https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator Thank you Rikuto Tauchi for reporting
- Source
- ff5b8ace-8b95-4078-9743-eac1ca5451de
- NVD status
- Analyzed
CVSS 3.1
- Type
- Primary
- Base score
- 4.8
- Impact score
- 2.7
- Exploitability score
- 1.7
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- Severity
- MEDIUM
- Hype score
- Not currently trending
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "05017ACE-D194-4FCC-BA25-BB44B0B0949E",
"versionEndExcluding": "8.5.16"
},
{
"criteria": "cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C74ED818-CCEF-437A-9127-5C479F56D39F",
"versionEndExcluding": "9.2.8",
"versionStartIncluding": "9.0.0"
}
],
"operator": "OR"
}
]
}
]