CyberRota Analysis
AI-GeneratedConcrete CMS versions prior to 9.5.3 are vulnerable to stored cross-site scripting (XSS) due to improper HTML-escaping of the Address attribute's country-less text formatter. This flaw allows an attacker to execute scripts in the session of any dashboard user who views the affected entry, potentially compromising user accounts and data integrity. Organizations using Concrete CMS should prioritize patching to version 9.5.3 or later to mitigate this high-severity risk.
Original NVD Description
In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association views. A user able to submit an Address attribute could execute script in the session of any dashboard user who opened the affected entry. The unescaped branch was reachable because a non-required Address attribute accepted a blank country, and because several Express association templates (for example concrete/elements/express/form/view/dashboard/association.php) echoed the association label mask without applying h(). The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.