Login Request a demo
Medium severity · published Aug 1, 2024
CVE-2024-4353
Stored XSS in Generate Board Name Input Field
4.8
CVSS
0.3%
EPSS
No
On KEV
Description
Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in the generate dashboard board instance functionality. The Name input field does not check the input sufficiently letting a rogue administrator have the capability to inject malicious JavaScript code. The Concrete CMS security team gave this vulnerability a CVSS v4 score of 4.6 with a vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Concrete versions below 9 are not affected by this vulnerability.Thanks fhAnso for reporting. (CNA updated this risk rank on 17 Jan 2025 by lowering the AC based on CVSS 4.0 documentation that access privileges should not be considered for AC).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Concrete CMS · Concrete CMS
9.0.0 through 9.3.2 · source: vendor, NVD, CISA
Affected product
CC
Concrete CMS
Concrete CMS
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-4353
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-4353
Release Notes
https://documentation.concretecms.org/9-x/developers/introduction/version-history/933-release-notes
Patch
https://github.com/concretecms/concretecms/pull/12151
More from Concrete CMS
9.6
CVE-2026-85385
Concrete CMS below 9.5.4 is vulnerable to Stored XSS via User Timezone Field
9.0
CVE-2026-18119
Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style values
8.8
CVE-2026-8409
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete
8.8
CVE-2026-8410
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete
8.8
CVE-2026-8411
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete