2 lines
4.1 KiB
JSON
2 lines
4.1 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Concrete CMS","repo":"https://github.com/concretecms/concretecms","vendor":"Concrete CMS","versions":[{"lessThan":"9.2.5","status":"affected","version":"9.0.0","versionType":"patch"}]}],"source":"ff5b8ace-8b95-4078-9743-eac1ca5451de"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*","matchCriteriaId":"4B4CD16D-4D2C-45DC-ACAC-E107A4909305","versionEndExcluding":"9.2.5","versionStartIncluding":"9.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS via the Role Name field since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Role Name field which might be executed when users visit the affected page. The Concrete CMS Security team scored this 2 with CVSS v3 vector AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator . Concrete versions below 9 do not include group types so they are not affected by this vulnerability. \n"},{"lang":"es","value":"La versión 9 de Concrete CMS anterior a la 9.2.5 es vulnerable al XSS almacenado a través del campo Role Name, ya que no hay validación suficiente de los datos proporcionados por el administrador para ese campo. Un administrador deshonesto podría inyectar código malicioso en el campo Role Name que podría ejecutarse cuando los usuarios visitan la página afectada. El equipo de seguridad de Concrete CMS obtuvo este 2 con el vector CVSS v3 vector AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator. Las versiones concretas inferiores a 9 no incluyen tipos de grupos, por lo que no se ven afectados por esta vulnerabilidad."}],"id":"CVE-2024-1247","lastModified":"2026-06-17T07:03:48.540","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.0,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":0.5,"impactScore":1.4,"source":"ff5b8ace-8b95-4078-9743-eac1ca5451de","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.7,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-1247","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-02-12T17:30:29.586336Z","version":"2.0.3"}}]},"published":"2024-02-09T19:15:24.183","references":[{"source":"ff5b8ace-8b95-4078-9743-eac1ca5451de","tags":["Release Notes","Vendor Advisory"],"url":"https://documentation.concretecms.org/9-x/developers/introduction/version-history/925-release-notes"},{"source":"ff5b8ace-8b95-4078-9743-eac1ca5451de","tags":["Vendor Advisory"],"url":"https://www.concretecms.org/about/project-news/security/2024-02-04-security-advisory"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"],"url":"https://documentation.concretecms.org/9-x/developers/introduction/version-history/925-release-notes"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.concretecms.org/about/project-news/security/2024-02-04-security-advisory"}],"sourceIdentifier":"ff5b8ace-8b95-4078-9743-eac1ca5451de","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"ff5b8ace-8b95-4078-9743-eac1ca5451de","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-79"}],"source":"nvd@nist.gov","type":"Primary"}]}
|