CVE-2024-4350 json
Concrete CMS version 9 below 9.3.3 and below 8.5.18 are vulnerable to Stored XSS in RSS Displayer
published 2024-08-09 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-2629 , GHSA-q5wx-m95r-4cgc
- cvss
- 4.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 42%
- public exploits
- 0
- none known
Summary
Concrete CMS versions 9.0.0 to 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in RSS Displayer when user input is stored and later embedded into responses. A rogue administrator could inject malicious code into fields due to insufficient input validation. The Concrete CMS security team gave this vulnerability a CVSS v4 score of 5.1 with vector https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Thanks, m3dium for reporting. (CNA updated this risk rank on 17 Jan 2025 by lowering the AC based on CVSS 4.0 documentation that access privileges should not be considered for AC)
Patch / fix
- packagist concrete5/concrete5 8.5.18, 9.3.3
- concretecms concrete_cms 8.5.18, 9.3.3
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| GitHub | 3.1 | 3.0 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N |
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | concrete5/concrete5 | <8.5.18 >=9.0.0RC1, <9.3.3 |
8.5.18 9.3.3 |
Affected products
- Concrete CMS Concrete CMS
Classification
References
-
github.com
/concretecms/concretecms/pull/12166
web, patch
-
github.com
/concretecms/concretecms/commit/c08d9671cec4e7afdabb547339c4bc0bed8eab06
web, patch
-
github.com
/concretecms/concretecms/commit/55e485e06b0b3342613a55af6a7c61d939d2ccb5
web
-
documentation.concretecms.org
/9-x/developers/introduction/version-history/933-release-notes?pk_vid=e367a434ef4830491723060415d52041
web, release-notes, vendor-advisory
-
documentation.concretecms.org
/developers/introduction/version-history/8518-release-notes?pk_vid=e367a434ef4830491723055758d52041
web, release-notes, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-4350
advisory
-
github.com
/concretecms/concretecms
package
Sources
- CVE List CVE-2024-4350
- GitHub Advisory GHSA-q5wx-m95r-4cgc
- NVD CVE-2024-4350
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.