CVE-2023-48649 | BDVDB-2026-217289 Detail
Description#
Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows stored XSS on the Admin page via an uploaded file name.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact none, availability impact none. Attack vector: network.
Weaknesses#
No weakness recorded in the source data.
References#
- https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release
- https://documentation.concretecms.org/developers/introduction/version-history/922-release-notes
- https://documentation.concretecms.org/developers/introduction/version-history/8513-release-notes
- https://github.com/concretecms/concretecms/pull/11695
- https://github.com/concretecms/concretecms/pull/11739
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.