Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2023-28820

Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was not sanitized.

VectorNETWORK

PublishedApr 28, 2023, 14:15

Published Bycve@mitre.org

Base Score

Score5.4

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

concrete5/concrete5(Packagist)09.1.0N/A

References

https://github.com/concretecms/concretecms/releases
https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20

Weakness Type

CWE-79

CVSS Metrics

Base Score

5.4

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK