GHSA-jxhp-rwqv-9fjj

ghsaUSosv

concrete5 vulnerable to Cross-site Scripting

view advisory published 2022-05-17Licence: CC-BY-4.0

Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to private messages or other unspecified vectors.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2015-3989US	medium4.3	0.93% (61st)	—	2015-05-15
Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to private messages…

references

External citations — patches, advisories, analysis.

https://documentation.concretecms.org/developers/introduction/version-history/5-7-4-release-notesWEB
https://github.com/concretecms/concretecmsPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2015-3989ADVISORY
https://web.archive.org/web/20200228094356/http://www.securityfocus.com/bid/74699WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan