CVE-2024-1247
CVSS 3.1 Score 2.0 of 10 (low)
Details
Summary
CVE-2024-1247 is a vulnerability found in Concrete CMS version 9 before 9.2.5, which is affected by stored cross-site scripting (XSS) attacks through the Role Name field. The lack of validation for administrator data in that field allows a malicious administrator to inject and execute harmful code when users visit the affected page. This vulnerability has been given a score of 2 with CVSS v3 vector AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N. Products affected include versions 9.2.4 and below of Concrete CMS, while versions below 9 are not impacted. To remediate this vulnerability, users should update their Concrete CMS installation to version 9.2.5 or higher. The potential danger posed by this vulnerability includes unauthorized access, data manipulation, and potential compromise of user systems or sensitive information.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions