CVE-2024-3180

Summary

CVE-2024-3180 is a stored XSS vulnerability affecting Concrete CMS versions below 9.2.8 and previous versions below 8.5.16. Malicious code can be injected into link-text fields when creating blocks of type file. This issue results from insufficient input validation. The vulnerability carries a CVSS v3.1 score of 3.1 with an attack vector of Network, an attack complexity of Low, and a privilege requirement of High. An attacker can exploit this flaw to inject malicious scripts and potentially steal user data or perform other malicious actions.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.