CyberRota Analysis
AI-GeneratedConcrete CMS versions prior to 9.5.3 are vulnerable to stored cross-site scripting (XSS) due to improper HTML entity encoding in user-defined Form block question labels, which can allow malicious scripts to execute in the browsers of administrators viewing the submissions report. This vulnerability poses a significant risk, as it could lead to unauthorized actions or data exposure within the administrative interface. Organizations using Concrete CMS should prioritize patching to version 9.5.3 or later to mitigate this high-severity risk.
Original NVD Description
Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard Form Submissions report (concrete/single_pages/dashboard/reports/forms/legacy.php). a rogue editor could store markup or script in a label that then executes in the browser of any administrator who opens the submissions report for the affected form, producing stored cross-site scripting in the Dashboard. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 8.4 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.