CVE-2023-44763

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-44763
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-44763.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-44763
Aliases
Published
2023-10-10T00:00:00Z
Modified
2026-10-28T02:30:32Z
Summary
[none]
Details

Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting (XSS). NOTE: the vendor's position is that a customer is supposed to know that "pdf" should be excluded from the allowed file types, even though pdf is one of the allowed file types in the default configuration.

Database specific 
{
    "cna_assigner":  "mitre",
    "isDisputed":  true,
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/44xxx/CVE-2023-44763.json"
}
References

Affected packages

Git / github.com/concretecms/concretecms

Affected ranges

Type
GIT
Repo
https://github.com/concretecms/concretecms
Events
Introduced
9cb42f30dcbdc42210d20f72abcbd6c752197968
Last Affected
9cb42f30dcbdc42210d20f72abcbd6c752197968
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:concretecms:concrete_cms:9.2.1:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "9.2.1"
                },
                {
                    "last_affected":  "9.2.1"
                }
            ],
            "source":  "CPE_STRING"
        }
    ]
}

Affected versions

9.*
9.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-44763.json"