CVE-2023-44766
MEDIUM 4.8EPSS 0.6%
A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from Page Settings. NOTE: the vendor disputes this because this SEO-related header change can only be made by an admin, and allowing an admin to place JavaScript there is an intentional customization feature.
- CVSS v3.1 NVD
- 4.8 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - CVSS v3.1 GitHub
- 5.4 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - EPSS
- 0.60% chance of exploitation in the next 30 days, 47th percentile
- Published
- 2023-10-06
- Updated
- 2024-08-02
Proof-of-concept exploits (1)
- sromanhu/CVE-2023-44766_ConcreteCMS-Stored-XSS---SEO0★ · 2023-09-25
Security advisories
- https://www.concretecms.org/about/project-news/security/security-advisory-2023-10-31-conc…
- advisories/GHSA-437p-jfm4-2387