CVE-2024-7394 Vulnerability Details

  /     /     /  

CVE-2024-7394 Metadata Quick Info

CVE Published: 08/08/2024 | CVE Updated: 24/09/2024 | CVE Year: 2024
Source: ConcreteCMS | Vendor: Concrete CMS | Product: Concrete CMS
Status : PUBLISHED

---

CVE-2024-7394 Description

Concrete CMS versions 9 through 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in getAttributeSetName().  A rogue administrator could inject malicious code. The Concrete CMS team gave this a CVSS v3.1 rank of 2 with vector AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator  and a CVSS v4.0 rank of 1.8 with vector CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N . Thanks, m3dium for reporting.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-20
CWE Name: CWE-20 Improper Input Validation
Source: Concrete CMS

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-592
CAPEC Description: CAPEC-592 Stored XSShttps://github.com/concretecms/concretecms/pull/12166


Source: NVD (National Vulnerability Database).