CVE-2024-7394 json
Concrete CMS version 9.0.0 through 9.3.2 and below 8.5.18 - Stored XSS in getAttributeSetName()
published 2024-08-08 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-2673 , GHSA-w6j6-w6jx-vf2r
- cvss
- 4.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
Concrete CMS versions 9 through 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in getAttributeSetName(). A rogue administrator could inject malicious code. The Concrete CMS team gave this a CVSS v4.0 rank of 4.6 with vector https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks, m3dium for reporting. (CNA updated this risk rank on 20 Jan 2025 by lowering the AC based on CVSS 4.0 documentation that access privileges should not be considered for AC)
Patch / fix
- packagist concrete5/concrete5 8.5.18, 9.3.3
- concretecms concrete_cms 8.5.18, 9.3.3
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 4.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| GitHub | 3.1 | 2.0 | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N |
| CNA | 4.0 | 4.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | concrete5/concrete5 | <8.5.18 >=9.0.0, <9.3.3 |
8.5.18 9.3.3 |
Affected products
- Concrete CMS Concrete CMS
Classification
References
-
github.com
/concretecms/concretecms/pull/12166
web, issue-tracking, patch
-
github.com
/concretecms/concretecms/commit/c08d9671cec4e7afdabb547339c4bc0bed8eab06
web, patch
-
github.com
/concretecms/concretecms/commit/3a5974e94892c43388c3529e57a140bf2967c734
web
-
github.com
/concretecms/concretecms/commit/e7e0eb95a0c4d0875c3712e33f495be76578cd5a
web
-
documentation.concretecms.org
/9-x/developers/introduction/version-history/933-release-notes?pk_vid=e367a434ef4830491723055753d52041
web, release-notes, vendor-advisory
-
documentation.concretecms.org
/developers/introduction/version-history/8518-release-notes?pk_vid=e367a434ef4830491723055758d52041
web, release-notes, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-7394
advisory
-
github.com
/concretecms/concretecms
package
Sources
- CVE List CVE-2024-7394
- GitHub Advisory GHSA-w6j6-w6jx-vf2r
- NVD CVE-2024-7394
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.