Stored XSS Vulnerability in Image Editor Background Color Affects Concrete CMS Versions 9.0.0 to 9.3.3 and Below 8.5.19

CVE-2024-8291

What is CVE-2024-8291?

Concrete CMS is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability within the Image Editor's background color functionality. This issue allows an unauthorized individual with administrator privileges to insert harmful scripts into the Thumbnails/Add-Type section. When exploited, this vulnerability could lead to significant security implications, including the potential for data exposure or system compromise, making it essential for users to upgrade to the latest versions and apply necessary patches immediately. Affected versions include 9.0.0 to 9.3.3 and versions prior to 8.5.19. For more details on the reported issues and solutions, refer to the official documentation and commits.

References