CVE-2024-3180 json
Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file
published 2024-04-03 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-1175 , GHSA-9qhc-pg6j-wf23
- cvss
- 3.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 29%
- public exploits
- 0
- none known
Summary
Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file. Stored XSS could be caused by a rogue administrator adding malicious code to the link-text field when creating a block of type file. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator . Thanks Alexey Solovyev for reporting.
Patch / fix
- packagist concrete5/concrete5 8.5.16, 9.2.8
- concretecms concrete_cms 8.5.16, 9.2.8
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.36% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.1 | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L |
| GitHub | 3.1 | 3.1 | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L |
| NVD | 3.1 | 4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | concrete5/concrete5 | >=9.0.0RC1, <9.2.8 <8.5.16 |
9.2.8 8.5.16 |
Affected products
- Concrete CMS Concrete CMS
Classification
References
-
github.com
/concretecms/concretecms/commit/822e689cefe1eb876e9de31dad9ce660f3b5c295
web
-
github.com
/concretecms/concretecms/commit/e85ef2408a5eea7d5646178fbef0ab243baaed8f
web
-
documentation.concretecms.org
/developers/introduction/version-history/8516-release-notes?_gl=1*1oa3zn1*_ga*MTc1NDc0Njk2Mi4xNzA2ODI4MDU1*_ga
web, release-notes
-
documentation.concretecms.org
/9-x/developers/introduction/version-history/928-release-notes?_gl=1*1bcxp5s*_ga*MTc1NDc0Njk2Mi4xNzA2ODI4MDU1*
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2024-3180
advisory
-
github.com
/concretecms/concretecms
package
Sources
- CVE List CVE-2024-3180
- GitHub Advisory GHSA-9qhc-pg6j-wf23
- NVD CVE-2024-3180
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.