CVE-2024-7512
Improper Input Validation (CWE-20)
Summary
Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in Board instances. A rogue administrator could inject malicious code.
Impact
This vulnerability allows a malicious administrator to inject and store malicious code in Board instances. When other users access these instances, the stored malicious code could be executed in their browsers, potentially leading to theft of sensitive information, session hijacking, or other client-side attacks. The impact is somewhat limited due to the high privileges required to exploit the vulnerability and the need for user interaction.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. The vulnerability has been addressed in Concrete CMS version 9.3.3.
Mitigation
1. Update Concrete CMS to version 9.3.3 or later. 2. If immediate updating is not possible, implement strict access controls for administrator accounts and monitor their activities closely. 3. Regularly audit Board instances for any suspicious content or code. 4. Implement Content Security Policy (CSP) headers to mitigate the impact of XSS attacks. 5. Educate users about the risks of clicking on suspicious links or interacting with unexpected content, even within the trusted CMS environment.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Timeline
Feedly found the first article mentioning CVE-2024-7512. See article
Feedly estimated the CVSS score as MEDIUM
NVD published the first details for CVE-2024-7512
A CVSS base score of 1.8 has been assigned.
A CVSS base score of 4.8 has been assigned.