| Package | Affected versions | Patched versions |
|---|---|---|
| concrete5/concrete5 | < 9.4.8 | 9.4.8 |
| concrete cms | < 9.4.8 | 9.4.8 |
In Concrete CMS below version 9.4.8, a user with permission to edit a page with element Legacy form can perform a stored XSS attack towards high-privilege accounts via the Question field.
The Concrete CMS security team thanks minhnn42, namdi and quanlna2 from VCSLab-Viettel Cyber Security for reporting.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free