In breve
- CVE-2023-44766 è una vulnerabilità MEDIO (CVSS 4.8) che riguarda concrete5/concrete5, concrete cms (concretecms).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.60%, superiore al 48.5% delle vulnerabilità.
- Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.
Description
A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from Page Settings.
NVD description
A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from Page Settings. NOTE: the vendor disputes this because this SEO-related header change can only be made by an admin, and allowing an admin to place JavaScript there is an intentional customization feature.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free