CVE-2024-2179
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2024-2179 is a stored Cross-Site Scripting (XSS) vulnerability affecting Concrete CMS version 9 before 9.2.7. Malicious code can be injected into the Name field of a Group type due to insufficient validation of administrator-provided data. This issue carries a CVSS v3.1 score of 2.2 with a high impact on the attacker's privileges (AV:N/AC:H), and a high impact on the attacked system's user interface (UI:N). A rogue administrator can leverage this vulnerability to execute malicious code when users visit the affected page. Versions of Concrete CMS below 9 are not susceptible to this issue as they do not include group types. Thanks to Luca Fuda for reporting this issue.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions