CVE-2024-1246

CVSS V2 None CVSS V3 None

Description

Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature due to insufficient validation of administrator provided data. A rogue administrator could inject malicious code when importing images, leading to the execution of the malicious code on the website user’s browser. The Concrete CMS Security team scored this 2 with CVSS v3 vector AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N. This does not affect Concrete versions prior to version 9.

Overview

CVE ID
CVE-2024-1246

Assigner
ConcreteCMS

Vulnerability Status
PUBLISHED

Published Version
2024-02-09T19:33:26.054Z

Last Modified Date
2024-02-09T21:54:30.346Z

Weakness Enumerations

CWE	URL
CWE-20	http://cwe.mitre.org/data/definitions/20.html

References

Reference URL	Reference Tags
https://documentation.concretecms.org/9-x/developers/introduction/version-history/925-release-notes
https://www.concretecms.org/about/project-news/security/2024-02-04-security-advisory

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-1246
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1246

History

Created	Old Value	New Value	Data Type	Notes
2024-06-26 05:40:38				Added to TrackCVE