CyberRota Analysis
AI-GeneratedConcrete CMS versions prior to 9.5.3 are vulnerable to stored cross-site scripting due to improper rendering of Express entry labels as raw HTML. This flaw allows unauthenticated attackers to inject malicious payloads via public Express Forms, which can execute in the context of an administrator's session or affect any visitor viewing associated entries. Organizations using affected versions should prioritize patching to mitigate potential exploitation risks, particularly those with public-facing forms.
Original NVD Description
Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scripting. An unauthenticated attacker could submit a payload through a public Express Form; it then executed in an administrator's dashboard session when the associated entry was viewed, or in the browser of any visitor to a page using an Express Entry List block with association columns, allowing actions to be performed with that user's privileges. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks v01demort for reporting.