Concrete CMS Cross-site Scripting via Survey Blocks

MOYENNE 5.4CVE-2021-28145 · GHSA-7388-7vq2-m4f4 · Published 18/03/2021 · updated 17/06/2026

En bref

CVE-2021-28145 est une vulnérabilité MOYENNE (CVSS 5.4) touchant concrete5/concrete5, concrete cms (concretecms).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.86%, plus élevée que 58.6% des vulnérabilités.
Correctif : mettre à jour vers 8.5.5 ou plus récent.

Package	Affected versions	Patched versions
concrete5/concrete5 Packagist	`< 8.5.5`	`8.5.5`
concrete cms concretecms	`< 8.5.5`	`8.5.5`

Description

Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct Cross-site Scripting (XSS) attacks via a crafted survey block. This requires at least Editor privileges.

NVD description

Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges.

References

nvd.nist.gov/vuln/detail/CVE-2021-28145 · ADVISORY
documentation.concrete5.org/developers/introduction/version-history/855-release-notes · WEB
S1lkys/CVE-2021-40101 · WEB
concrete5.org/developers/security · WEB

Autres vulnérabilités de concrete5/concrete5

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

concrete5/concrete5

Packagist

< 8.5.5

8.5.5

concrete cms

concretecms

< 8.5.5

8.5.5

Description

Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct Cross-site Scripting (XSS) attacks via a crafted survey block. This requires at least Editor privileges.

NVD description

Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges.

Autres vulnérabilités de concrete5/concrete5

Tout voir →