CVE-2023-49337

Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name

Low · published December 25, 2023

CVSS v3.1
2.4
EPSS
1%
Percentile
45.2
In the wild
Unconfirmed
What it is

Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. (8.5 and earlier are unaffected.)

The record
Technical detail
CVSS v3.1
2.4 · LOW
Vector
CVSS:3.1/AC:L/AV:N/A:N/C:N/I:L/PR:H/S:U/UI:R
CVSS v4.0
Not supplied
EPSS
0.00550 · 45.2th percentile
Published
2023-12-25T00:00Z
EPSS history
Timeline
  • 25 DEC 00:00Z
    Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name
    cvelistv5