Concrete CMS Cross-site Scripting via Survey Blocks

MEDIO 5.4CVE-2021-28145 · GHSA-7388-7vq2-m4f4 · Published 18/03/2021 · updated 17/06/2026

En resumen

CVE-2021-28145 es una vulnerabilidad MEDIO (CVSS 5.4) que afecta a concrete5/concrete5, concrete cms (concretecms).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.86%, mayor que el 58.6% de las vulnerabilidades.
Solución: actualizar a 8.5.5 o posterior.

Package	Affected versions	Patched versions
concrete5/concrete5 Packagist	`< 8.5.5`	`8.5.5`
concrete cms concretecms	`< 8.5.5`	`8.5.5`

Description

Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct Cross-site Scripting (XSS) attacks via a crafted survey block. This requires at least Editor privileges.

NVD description

Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges.

References

nvd.nist.gov/vuln/detail/CVE-2021-28145 · ADVISORY
documentation.concrete5.org/developers/introduction/version-history/855-release-notes · WEB
S1lkys/CVE-2021-40101 · WEB
concrete5.org/developers/security · WEB

Más vulnerabilidades de concrete5/concrete5

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

concrete5/concrete5

Packagist

< 8.5.5

8.5.5

concrete cms

concretecms

< 8.5.5

8.5.5

Description

Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct Cross-site Scripting (XSS) attacks via a crafted survey block. This requires at least Editor privileges.

NVD description

Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges.

Más vulnerabilidades de concrete5/concrete5

Ver todo →