CVE-2023-28475

Опубликовано: 28 апр. 2023

Источник: nvd

CVSS3: 6.1

EPSS Низкий

Описание

Concrete CMS (previously concrete5) versions 8.5.12 and below, and versions 9.0 through 9.1.3 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized.

Ссылки

https://concretecms.com
Product
https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release
https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20
Vendor Advisory
https://concretecms.com
Product
https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release
https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*

Версия до 9.2.0 (исключая)

EPSS

Процентиль: 80%

0.01329

Низкий

6.1 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-vcpr-hm2m-gjjj