CVE-2024-1245 json
Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes
published 2024-02-09 2 y ago modified 2026-06-17 4 mo ago also GHSA-mgp6-j658-vcw9 , EUVD-2024-0673
- cvss
- 2.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 34%
- public exploits
- 0
- none known
Summary
Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes since administrator entered file attributes are not sufficiently sanitized in the Edit Attributes page. A rogue administrator could put malicious code into the file tags or description attributes and, when another administrator opens the same file for editing, the malicious code could execute. The Concrete CMS Security team scored this 2.4 with CVSS v3 vector AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N.
Patch / fix
- packagist concrete5/concrete5 9.2.5
- Concrete CMS Concrete CMS 9.2.5
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 2.4 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 2.4 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | concrete5/concrete5 | >=9.0.0RC1, <9.2.5 |
9.2.5 |
Affected products
- Concrete CMS Concrete CMS
Classification
References
-
github.com
/concretecms/concretecms/commit/59a07472ad6349a2c5fb455837a54ed1fe3f6953
web
-
documentation.concretecms.org
/9-x/developers/introduction/version-history/925-release-notes
web, release-notes, vendor-advisory
-
concretecms.org
/about/project-news/security/2024-02-04-security-advisory
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-1245
advisory
-
github.com
/concretecms/concretecms
package
Sources
- CVE List CVE-2024-1245
- GitHub Advisory GHSA-mgp6-j658-vcw9
- NVD CVE-2024-1245
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.