2 lines
4.6 KiB
JSON
2 lines
4.6 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Concrete CMS","repo":"https://github.com/concretecms/concretecms","vendor":"Concrete CMS","versions":[{"lessThan":"9.4.0","status":"affected","version":"9.0.0","versionType":"git"}]}],"source":"ff5b8ace-8b95-4078-9743-eac1ca5451de"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*","matchCriteriaId":"D14920EA-2BF7-4833-89BE-F761AD3CFF56","versionEndExcluding":"9.4.0","versionStartIncluding":"9.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Concrete CMS versions 9.0.0 through 9.3.9 are affected by a stored XSS in Folder Function.The \"Add Folder\" functionality lacks input sanitization, allowing a rogue admin to inject XSS payloads as folder names. The Concrete CMS security team gave this vulnerability a CVSS 4.0 Score of 4.8 with vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N. Versions below 9 are not affected. Thanks, Alfin Joseph for reporting."},{"lang":"es","value":"Las versiones 9.0.0 a 9.3.9 de Concrete CMS se ven afectadas por un XSS almacenado en la función de carpeta. La funcionalidad \"Agregar carpeta\" carece de depuración de entrada, lo que permite que un administrador malintencionado inyecte payloads XSS como nombres de carpeta. El equipo de seguridad de Concrete CMS le dio a esta vulnerabilidad una puntuación CVSS 4.0 de 4.8 con el vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N. Las versiones anteriores a la 9 no se ven afectadas. Gracias, Alfin Joseph, por informar."}],"id":"CVE-2025-0660","lastModified":"2026-06-17T08:26:55.070","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.7,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff5b8ace-8b95-4078-9743-eac1ca5451de","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-0660","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-03-11T15:38:19.884152Z","version":"2.0.3"}}]},"published":"2025-03-10T21:15:40.110","references":[{"source":"ff5b8ace-8b95-4078-9743-eac1ca5451de","tags":["Release Notes"],"url":"https://documentation.concretecms.org/9-x/developers/introduction/version-history/940-release-notes"},{"source":"ff5b8ace-8b95-4078-9743-eac1ca5451de","tags":["Issue Tracking"],"url":"https://github.com/concretecms/bedrock/pull/370"},{"source":"ff5b8ace-8b95-4078-9743-eac1ca5451de","tags":["Issue Tracking","Patch"],"url":"https://github.com/concretecms/concretecms/pull/12454"}],"sourceIdentifier":"ff5b8ace-8b95-4078-9743-eac1ca5451de","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"ff5b8ace-8b95-4078-9743-eac1ca5451de","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-79"}],"source":"nvd@nist.gov","type":"Primary"}]}
|