Concrete CMS version 9 prior to 9.2.8 and previous versions prior to 8.5.16 are vulnerable to Stored XSS in the Search Field.

Concrete CMS version 9 prior to 9.2.8 and previous versions prior to 8.5.16 are vulnerable to Stored XSS in the Search Field. Prior to the fix, stored XSS could be executed by an administrator changing a filter to which a rogue administrator had previously added malicious code. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator . Thanks Alexey Solovyev for reporting

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

PortlandLabs Concrete CMS 安全漏洞

PortlandLabs Concrete CMS是美国PortlandLabs公司的一个面向团队的开源内容管理系统。 Concrete CMS存在安全漏洞，该漏洞源于存在存储型跨站脚本（XSS）漏洞。以下产品及版本受到影响：Concrete CMS 9.2.8之前的９版本，8.5.16之前版本。

N/A

N/A