CVE-2024-8291
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Summary
Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in Image Editor Background Color. A rogue admin could add malicious code to the Thumbnails/Add-Type.
Impact
This vulnerability allows a rogue admin to inject malicious code into the Thumbnails/Add-Type feature of the Image Editor Background Color. The impact is limited, as it requires high privileges (admin access) and has low confidentiality impact with no integrity or availability impact. The CVSS v4 score is 2.1 (Low severity), and the CVSS v3.1 score is 4.8.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. The vulnerability has been addressed in versions after 9.3.3 and 8.5.19.
Mitigation
Update Concrete CMS to the latest version (after 9.3.3 for the 9.x branch, or after 8.5.19 for the 8.x branch). Additionally, implement strict access controls and monitor admin activities, especially those related to the Image Editor and Thumbnail functionalities.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Timeline
Feedly found the first article mentioning CVE-2024-8291. See article
Feedly estimated the CVSS score as MEDIUM
NVD published the first details for CVE-2024-8291
A CVSS base score of 2.1 has been assigned.
EPSS Score was set to: 0.05% (Percentile: 16.3%)
A CVSS base score of 2.1 has been assigned.
A CVSS base score of 4.8 has been assigned.