Concrete CMS Multiple XSS Vulnerabilities Fixed (CVE-2024-8291/7398/8661)

From this webpage screenshot, the following key vulnerability information can be obtained: 1. Vulnerability Type: - XSS (Cross-Site Scripting): Cross-site scripting attack. 2. Affected Versions: - 8.5.19: Concrete CMS version 8.5.19 is vulnerable. - 8.5.16: Concrete CMS version 8.5.16 is vulnerable. - 8.5.15: Concrete CMS version 8.5.15 is vulnerable. - 8.5.14: Concrete CMS version 8.5.14 is vulnerable. - 8.5.13: Concrete CMS version 8.5.13 is vulnerable. - 8.5.10–12: Concrete CMS versions 8.5.10 to 8.5.12 are vulnerable. - 8.5.9: Concrete CMS version 8.5.9 is vulnerable. - 8.5.8: Concrete CMS version 8.5.8 is vulnerable. - 8.5.7: Concrete CMS version 8.5.7 is vulnerable. 3. Fixed Vulnerabilities: - CVE-2024-8291: In the Image Editor Background Color feature, the XSS vulnerability was fixed by sanitizing the output of "Save Background Image Colour" in the file thumbnail dashboard single page. - CVE-2024-7398: In the Calendar Event Addition Feature, the XSS vulnerability was fixed by sanitizing event names in versions 8 and 9. - CVE-2024-8661: In the "Next&Previous Nav" block, the XSS vulnerability was fixed by sanitizing output in version 8. 4. Fixed in Commits: - commit dbce253166f6b10ff3e0c09e50fd395370b8b065: Fixed CVE-2024-8291. - commit 7c8ed0d1d9db0d7f6df7fa066e0858ea618451a5: Fixed CVE-2024-7398. - commit ce5ee2ab83fe8de6fa012dd51c5a1dde05cb0dc4: Fixed CVE-2024-8661. 5. Security Team Assessment: - Concrete CMS Security Team: Evaluated these vulnerabilities and assigned corresponding CVSS (Common Vulnerability Scoring System) scores. This information helps users understand which security vulnerabilities exist in different versions of Concrete CMS and provides corresponding remediation measures.

Goal Reached Thanks to every supporter — we hit 100%!

Concrete CMS Multiple XSS Vulnerabilities Fixed (CVE-2024-8291/7398/8661)