CVE-2023-44760
Quick assessment
Affected
n/a n/a
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PortlandLabs Concrete CMS是美国PortlandLabs公司的一个面向团队的开源内容管理系统。 PortlandLabs Concrete CMS v.9.2.1版本存在跨站脚本漏洞，该漏洞源于组件Header and Footer Tracking Codes存在多个跨站脚本（XSS）漏洞。
Possible ATT&CK Techniques 1 AI
T1059.007 · JavaScript
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-44760
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS v.9.2.1 allow an attacker to execute arbitrary code via a crafted script to the Header and Footer Tracking Codes of the SEO & Statistics. NOTE: the vendor disputes this because these header/footer changes can only be made by an admin, and allowing an admin to place JavaScript there is an intentional customization feature. Also, the exploitation method claimed by "sromanhu" does not provide any access to a Concrete CMS session, because the Concrete CMS session cookie is configured as HttpOnly.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
PortlandLabs Concrete CMS 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PortlandLabs Concrete CMS是美国PortlandLabs公司的一个面向团队的开源内容管理系统。 PortlandLabs Concrete CMS v.9.2.1版本存在跨站脚本漏洞，该漏洞源于组件Header and Footer Tracking Codes存在多个跨站脚本（XSS）漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2023-44760
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | Multiple Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the Header and Footer Tracking Codes of the SEO & Statistics | https://github.com/sromanhu/CVE-2023-44760_ConcreteCMS-Stored-XSS---TrackingCodes | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-44760
请登录查看更多情报信息。
Other References for CVE-2023-44760 (3)
Same Patch Batch · n/a · 2023-10-23 · 18 CVEs total
| CVE-2023-27152 | Deciso OPNsense 安全漏洞 | |
| CVE-2023-46603 | International Color Consortium DemoIccMAX 缓冲区错误漏洞 | |
| CVE-2023-46602 | International Color Consortium DemoIccMAX 79ecb74 缓冲区错误漏洞 | |
| CVE-2023-42295 | OpenImageIO 输入验证错误漏洞 | |
| CVE-2023-27149 | Enhancesoft osTicket 跨站脚本漏洞 | |
| CVE-2023-27148 | Enhancesoft osTicket 跨站脚本漏洞 | |
| CVE-2023-46324 | free5GC 数据伪造问题漏洞 | |
| CVE-2023-46332 | WebAssembly 缓冲区错误漏洞 | |
| CVE-2023-46331 | WebAssembly 缓冲区错误漏洞 | |
| CVE-2023-46059 | Geeklog 跨站脚本漏洞 | |
| CVE-2023-37635 | Uvdesk 安全漏洞 | |
| CVE-2023-37636 | Uvdesk 跨站脚本漏洞 | |
| CVE-2023-45966 | remak42 代码问题漏洞 | |
| CVE-2023-43358 | CMS Made Simple 跨站脚本漏洞 | |
| CVE-2023-45998 | kodbox 跨站脚本漏洞 | |
| CVE-2023-33517 | carRental 安全漏洞 | |
| CVE-2023-46058 | Geeklog 跨站脚本漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2023-44760
No comments yet