CVE-2023-28474

Description

Concrete CMS (previously concrete5) before 9.2 is vulnerable to Stored XSS on Saved Presets on search.

How to fix CVE-2023-28474

To remediate CVE-2023-28474, upgrade the affected package to a fixed version below.

• Packagist/concrete5/concrete5—upgrade to 9.2.0 or later

Is CVE-2023-28474 being exploited?

Low — EPSS is 1.9%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 9.2.0

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-28474
• PATCHgithub.com/concretecms/concretecms
• WEBconcretecms.com
• WEBwww.concretecms.org/about/project-news/security/2023-12-05-concrete-cms-new-cves-and-cve-updates