CVE-2024-3178

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-3178

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-3178.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-3178

Aliases

GHSA-xwrh-qxmc-x8c8

Published

2024-04-03T19:15:44.210Z

Modified

2026-04-10T05:12:32.301782Z

Severity

4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

Concrete CMS versions 9 below 9.2.8 and versions below 8.5.16 are vulnerable to Cross-site Scripting (XSS) in the Advanced File Search Filter. Prior to the fix, a rogue administrator could add malicious code in the file manager because of insufficient validation of administrator provided data. All administrators have access to the File Manager and hence could create a search filter with the malicious code attached. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator .

References

Affected packages

Git / github.com/concretecms/concretecms

Affected ranges

Type

GIT

Repo

https://github.com/concretecms/concretecms

Events

Introduced

Fixed

17020e35940cdec1493c63065af6a2245e00d402

Introduced

b3774abddd475b4ba98b637402506f7a5ebd90ea

Fixed

54cb334ddefcc6d516fc59d5e21404497da27a6d

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "8.5.16"
        },
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.2.8"
        }
    ]
}

Affected versions

5.*

5.7.0

5.7.0.1

5.7.0.3

5.7.0.4

5.7.1

5.7.2

5.7.2.1

5.7.3

5.7.3.1

5.7.4.1

5.7.5.2

5.7.5.5

5.7.5.6

5.7.5.7

8.*

8.1.0

8.2.0

8.2.0RC2

8.2.1

8.3.1

8.4.1

8.5.13

8.5.14

8.5.15

8.5.6

8.5.7

8.5.9

9.*

9.2.2

9.2.3

9.2.4

9.2.5

9.2.6

9.2.7

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-3178.json"