CVE-2023-28819

Concrete CMS (previously concrete5) versions 8.5.12 and below, 9.0.0 through 9.0.2 is vulnerable to Stored XSS in uploaded file and folder names

Low · published April 28, 2023

CVSS v3.1
3.5
EPSS
1%
Percentile
50.0
In the wild
Unconfirmed
What it is

Concrete CMS (previously concrete5) versions 8.5.12 and below, 9.0.0 through 9.0.2 is vulnerable to Stored XSS in uploaded file and folder names.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:H/S:U/UI:R
CVSS v4.0
Not supplied
EPSS
0.00640 · 50.0th percentile
Published
2023-04-28T00:00Z
EPSS history
Timeline
  • 28 APR 00:00Z
    Concrete CMS (previously concrete5) versions 8.5.12 and below, 9.0.0 through 9.0.2 is vulnerable to Stored XSS in uploaded file and folder names
    cvelistv5